Tender risk management: write answers buyers can trust

What is tender risk management?

Risk management means identifying what could prevent successful contract delivery, assessing the likelihood and impact, and explaining how you’ll manage it. Your answer should show the buyer what could go wrong, who is accountable and what happens next.

As an evaluator, I’m looking for controls I can understand and evidence I can trust. A policy name alone gives me very little to score.

Start with the buyer’s requirements, then build an answer around specific risks, credible actions and clear ownership.

Key takeaways

• Start with the tender documents and connect each requirement to specific contract risks, controls and evidence.
• Use a five-step process: identify risks, analyse likelihood and impact, prioritise them, set out actions and monitor them throughout delivery.
• Name an owner, trigger, review point and escalation route for each significant risk. Explain residual risk and support ratings with evidence.
• Show how your controls address the buyer’s procure-to-pay concerns, including supplier, market, contract, operational, financial and compliance risks.
• Tailor risk answers and appendices to the contract, follow the buyer’s format and scoring instructions, and check the applicable UK procurement rules.

Read the tender before drafting

Even if your team already manages risk well, the buyer needs to see how that approach works on this contract.

Read every tender document side by side, from the specification and draft contract to the evaluation criteria and response instructions. Then use your risk assessment to link each requirement to the service you’re proposing.

Separate mandatory conditions from scored questions and delivery obligations. A missing insurance level can create contract risk, while a weak continuity answer can lose marks.

Look closely at the financial tests and staffing requirements, along with any reporting deadlines, subcontracting conditions and liability clauses. These often show where the buyer sees supplier risk. If there’s a buyer engagement event, go along, and raise anything unclear through formal clarification questions as early as you can.

Engagement events help you understand the service, and your response should then follow what the final tender documents say.

Our guidance on how evaluators assess tender responses explains why clear, findable evidence matters. Don’t leave the evaluator joining the dots between your policy folder and your proposed service.

Follow the five-step risk management process

The CIPS risk management process sets out five steps you can use in a tender answer. They align with the ISO 31000 framework for identifying, assessing and treating risks.

1. Identify the risks

Start by listing what could get in the way of delivering this contract. Some threats will come from inside your organisation, such as a restructure, a change programme or a shift in company direction.

Others will come from outside, whether that’s the economy, new legislation, technology or changes in the local population. As an evaluator, I see plenty of PESTLE headings copied straight into answers. What I want to know is how a specific change could affect this service and what you’d do about it.

2. Analyse likelihood and impact

You can rate risks in words, in numbers or with a mix of both. Pick the method that fits the size of the contract and the data you have to back it up.

A simple high, medium or low rating is usually enough for everyday operational risks. Financial exposure or demand forecasting may need proper numbers. Whichever you use, keep the precision in line with your evidence, because a risk scored to two decimal places with nothing behind it won’t convince anyone.

3. Assess which risks need attention

Compare the analysis with agreed tolerances and the buyer’s requirements. Decide which risks need urgent treatment, senior approval or continued observation.

Some risks need attention even when they’re unlikely to happen. If the consequence involves safeguarding, a critical service or sensitive data, a low likelihood rating on its own won’t be enough to reassure the buyer.

4. Set out the action plan

Options include avoiding a risky activity, transferring or sharing exposure through insurance or an agreement, and reducing risk.

Reduction may lower the probability, the impact or both. Your action plan should name each control, its owner and completion point. Explain the remaining exposure after controls, known as residual risk.

5. Monitor continuously

Monitoring continues throughout delivery. State how often reviews will take place, which indicators could signal a problem and what thresholds trigger escalation.

A register that only gets opened at contract review meetings won’t tell anyone much. Show the buyer how you’ll keep it live, what data you’ll track and who acts when a threshold is crossed. If you use risk management software, explain what it monitors and how your team responds to it.

Connect your risks to the buyer’s purchasing process

Buyers think about risk across the whole buying process, from the moment a need is raised to the point they pay your invoice. It helps to look at your answer through their eyes and check you’ve covered the concerns they’re likely to have at each stage.

The table below sets out those stages, the type of risk the buyer is likely to be thinking about and what your answer can do to reassure them.

Stage	Risk category	What your answer should address
Intake, when a need is raised	Supplier risk	Your capability, capacity and checks on key suppliers
Sourcing	Market risk	Availability, price pressures and alternatives that protect delivery
Contracting	Contract risk	How you’ll meet obligations, manage liabilities and assign responsibilities
Ordering	Operational risk	Controls for delivery failures, errors and service continuity
Invoicing	Financial risk	Accurate invoicing that matches what was ordered and delivered
Payment	Compliance risk	Applicable anti-money laundering checks and environmental, social and governance declarations

In practice these risks overlap. If a key subcontractor fails, for example, it can hit your service delivery, your finances and your contract performance all at once. Where that kind of knock-on effect matters, explain it briefly so the evaluator can see you’ve thought it through.

Build a risk appendix evaluators can use

If the buyer requests a detailed risk assessment as an appendix, give it the same attention as the main answer.

Make the register specific and accountable

A risk register records threats, consequences, controls and owners. Each entry should connect the initial and residual ratings to the control, owner, review date and escalation trigger.

Take staff absence as an example. Explain how it could leave you short of the cover the contract needs, then set out your cover arrangements and who is accountable for them. Say what triggers those arrangements and how you know replacement staff have the right skills, then link the residual rating to those controls.

ISO 31000 and COSO’s enterprise risk management framework provide principles for identification, assessment, treatment and monitoring. Your risk register, reporting tools and management routines put those principles into practice.

Explain what the scores mean

A scoring matrix in the risk register prioritises risks numerically, often by multiplying likelihood by impact. Define each rating and the action plan required for each score.

For example, a risk might score like this:

Rating point	Likelihood	Impact	Score
Before controls	3	4	12
After controls	2	4	8

If the residual score drops, explain why and show the evidence that your control makes a difference. In this example the likelihood falls but the impact stays at 4, because the consequence would be the same if the event did happen.

A risk heat map plots likelihood against impact and gives the evaluator a quick visual summary. Use it alongside the register and your written explanation.

A green residual rating needs evidence that the control changes the risk. When I’m evaluating, a colour on its own gives me nothing to score.

Answer common tender risk questions directly

Buyers want to understand whether delivery will hold up under pressure. Give them the operational detail behind your reassurance.

Workforce restrictions and supply chain disruption

Some specifications still ask about COVID-19 restrictions, isolation or pandemic arrangements. Answer the actual requirement using current infection-control and absence arrangements. Explain cover, competence checks and communication responsibilities.

For supplier risk, name critical dependencies, alternative arrangements and switching constraints. An alternative supplier is only useful if they can provide the required capacity, quality and lead times.

The CIPS supply chain risk guidance treats changing dependencies as an ongoing management task.

Business continuity and financial risk

Business continuity means keeping essential services operating during disruption. Explain what activates the plan, who decides, what continues and how recovery is tested.

Financial risk answers should address cashflow, delayed payment, cost increases and the assumptions behind your price. Keep these consistent with your pricing submission.

“We have robust business continuity arrangements” gives me little to assess. What I would be looking for is the responsible role, activation point, recovery priority and evidence of testing.

A promise to absorb every future cost increase also deserves scrutiny. Explain a financially credible approach that matches the contract terms.

Understand the UK public procurement context

It helps to know which rules the buyer is working under before you write your risk answer. Under the Procurement Act 2023, contracts at or above the relevant threshold usually go through a regulated competitive procedure, and the thresholds vary by type of buyer and contract. Scottish devolved procurement follows its own rules, so check which regime applies before you start.

Contracts under the Act are awarded to the Most Advantageous Tender, judged against the published criteria. That means quality, including how well you handle risk, carries real weight alongside price.

Central government departments and their arm’s-length bodies must give social value at least 10% of the total score, and HMRC sets out its minimum social value weighting as one example. Other public buyers can choose their own weighting, so check the evaluation criteria for each tender.

If you’re used to the old Contracts Finder figures of £10,000 and £25,000, those have been replaced. Under the Act, below-threshold contracts become notifiable from £12,000 for central government and £30,000 for other contracting authorities, both including VAT, and those notices are published on Find a Tender.

These figures trigger the notice requirements only. A full regulated procedure applies at the higher thresholds, and smaller contracts may still be competed under the buyer’s own rules.

Avoid mistakes before submission

The most common weakness is a gap between the risk named and the control promised.

I regularly see answers that say “experienced staff” when the question is about absence cover, or “fully insured” when it’s about how the service recovers. A monthly meeting may also be too slow for a risk that needs action within hours.

Before submission, ask:

• Does every significant risk explain the consequence for this buyer?
• Have we named the owner, control, trigger and escalation route?
• Is there evidence behind each claimed control?
• Do the register, narrative, staffing plan and price agree?
• Have we followed the appendix, format and word-limit instructions?

Don’t assume an evaluator will read an unrequested attachment or use it to fill gaps in a scored answer. Put the essential explanation where the question asks for it.

Our practical bid review checklist can help your team test the wider submission too. Leave time for someone outside the drafting group to challenge the assumptions.

Give the evaluator a clear basis for confidence

A strong tender risk management answer makes your judgement visible. It shows that you understand the exposure, have practical controls and know when to act.

Keep ownership, evidence and residual risk clear. Your team should be able to deliver what the answer promises.

At Bidsmithery™, we help teams understand the scoring behind stronger answers. If this is a recurring gap, our evaluator-led bid and tender training can help your team build the skill while keeping control of its bids.

Frequently asked questions