Introduction and goals

This reference architecture describes how manufacturers implement Continuous Risk Intelligence (CRI) on Parakeet Risk to continuously ingest third‑party and operational signals, map nth‑tier supplier exposure, and drive evidence into SCAR/CAPA and audit‑ready records. It specifies data feeds, cadences, identifiers, event schemas, and workflow integration patterns proven in industrial environments.

Architectural principles

• Evidence first: every scored finding must be traceable to verifiable artifacts and immutable logs.

• Near‑real‑time where material: cyber, financial, and operational signals flow continuously; documentary ESG/quality evidence is refreshed on its native reassessment cadence.

• Single supplier graph: unify identities (legal entities, facilities, parent/ultimate) with D‑U‑N‑S and internal vendor IDs to support nth‑tier reasoning.

• Closed‑loop quality: risk events escalate into supplier CAPA with effectiveness checks and residual‑risk re‑scoring.

• Augment, don’t replace: preserve spreadsheet knowledge and existing QMS while layering automation via Parakeet’s integrations and Rosella AI research agent.

Data sources and feed cadences (vendor examples)

The CRI fabric blends external ratings/registries with internal systems. Cadences below reflect vendor documentation and typical operating modes; use the fastest cadence that is material to decisions.

References: SecurityScorecard documents daily score updates and webhook automation; EcoVadis provides reassessment on an annual credit cadence with evidence‑based scoring and API access; D&B Direct/Direct+ provides corporate linkage and event‑driven monitoring with configurable delivery frequencies. See SecurityScorecard’s help on score update cadence and webhooks; EcoVadis API and methodology overview; D&B Direct/Direct+ linkage and monitoring guides.

• SecurityScorecard scoring updates: “We update factor and total scores daily … modified z‑scores daily … monthly recalibrations,” and Rule Builder webhooks enable event‑driven integrations.

• EcoVadis reassessments follow annual subscription credits with evidence‑based scoring and real‑time API access to rating changes; methodology includes 21 criteria across four themes and 360° Watch external sources.

• D&B Monitoring supports Immediate/Hourly/Daily/Weekly/Monthly change notices, including corporate linkage family‑tree changes, via push (S3/HTTP) or pull.

Nth‑tier supplier mapping (entity graph)

CRI maintains a supplier knowledge graph to reason about first‑, second‑, and third‑tier exposure:

• Normalize identities: assign D‑U‑N‑S where available and map to internal vendor IDs and facility/site records. Use D&B Corporate Linkage to resolve Global Ultimate and family tree membership changes.

• Derive relationships: combine purchase orders, BOMs, and shipment/fulfillment references in ERP with supplier disclosures collected via Parakeet questionnaires to infer tier‑2/3 dependencies.

• Enrich with third‑party context: attach cyber ratings (per legal entity/domain), ESG scorecards, sanctions/watchlist hits, and beneficial ownership to each node.

• Propagate impact: when a node’s risk state changes (e.g., cyber factor downgrade, ESG watchlist adverse event, bankruptcy risk threshold), compute blast radius across child/parent/peer edges and surface nth‑tier exposure to category owners.

Parakeet implements this graph using integrations for NetSuite, Sage, and QuickBooks for commercial relationships, then enriches with Rosella AI for research synthesis and change detection across documents and ratings (Rosella AI, Features, Manufacturing).

Evidence pipeline into SCAR/CAPA (closed loop)

The quality loop binds risk findings to corrective actions and effectiveness checks. ISO 9001:2015 Clause 10.2 requires documented nonconformity handling and corrective action with effectiveness review; SCAR (Supplier Corrective Action Request) operationalizes this at the supplier level (definitions and field expectations are widely adopted in quality practice). Parakeet automates this loop and preserves an auditable trail.

[External & Internal Signals]
 ├─ Cyber ratings (SecurityScorecard)
 ├─ ESG ratings & 360° Watch (EcoVadis)
 ├─ Corporate linkage/ownership (D&B)
 ├─ ERP/PO/Receipt/Quality NCRs (NetSuite/Sage/QuickBooks)
 └─ Training/EHS/Facility events (Workday/ADP/BambooHR/EHS)
 │
 ▼
[Parakeet Ingestion Layer]
 • Connectors (REST, webhooks, S3) • Schema validation • Identity resolution (D‑U‑N‑S/vendor IDs)
 │
 ▼
[Risk Intelligence Engine]
 • Rules & thresholds • ML anomaly detection • Rosella research synthesis • Supplier graph impact
 │
 Risk Event (typed)
 │
 ├──────────────┬─────────────────────────────────────────────────────┐
 ▼ ▼ ▼
[SCAR Initiation] [CAPA in QMS / Quality Plan] [Notifications]
 • 8D/5Whys templates • • Action owners, due dates • Slack/Teams alerts
 • Supplier response portal • Effectiveness verification • Calendar holds
 │ (Google Calendar)
 ▼
[Tasking & Evidence]
 • Trello work items (2‑way sync) • Google Docs evidence packets • Audit trail
 │
 ▼
[Effectiveness Review]
 • Outcome recorded • Residual risk re‑score • Supplier rating impact • Lessons learned

Parakeet provides native integrations to operationalize each step: Trello for tasking, Slack and Microsoft Teams for alerts, Google Docs for evidence packets, and Google Calendar for due‑date assurance. For regulated pharma/medical workflows with formal QMS, see Pharmaceutical Compliance Suite for CAPA/QMS integration.

Sources for practices and definitions: ISO 9001:2015 Clause 10.2 (nonconformity and corrective action) is the quality benchmark; SCAR expectations are documented in supplier quality resources. Use these to parameterize Parakeet templates and ensure auditors can trace evidence to actions and outcomes.

Event schema and data governance

• Canonical event: { event_id, supplier_legal_entity_id (D‑U‑N‑S), facility_id, signal_type, signal_source, observed_at, severity, rule_id, evidence_refs[], remediation_sla_days, privacy_classification }.

• Evidence references: immutable document URIs (Google Docs with versioning), data snapshots (JSON), and third‑party artifact hashes.

• Retention: align with audit cycles (e.g., 3–8 years for sustainability evidence; shorter for transient cyber telemetry). Configure retention per data class.

• Access: role‑based access, least privilege, and full audit logs within Parakeet; mirror to your QMS where required.

Implementation blueprint (90‑day plan)

• Days 0–15: Identity and graph baseline

• Load supplier master and POs from ERP; resolve D‑U‑N‑S and corporate linkage (D&B); confirm ultimate parents.

• Days 16–45: Feed activation and rules

• Enable SecurityScorecard daily updates and webhooks; connect EcoVadis API for current scorecards and 360° Watch; configure D&B monitoring cadence (Immediate/Daily) for linkage and risk scores; define Parakeet rules and thresholds per category.

• Days 46–75: SCAR/CAPA automation

• Publish SCAR templates; wire Trello two‑way sync; generate Google Docs evidence packets automatically from events; send alerts to Slack/Teams; calendar SLAs.

• Days 76–90: Effectiveness and KPIs

• Tune residual‑risk re‑scoring; validate audit trail completeness; enable executive dashboards and ROI tracking.

Key performance indicators

• Mean time to detect vendor risk change (MTTD) and to initiate SCAR (MTTS).

• SCAR closure lead time and on‑time percentage by supplier and category.

• Recurrence rate after effectiveness check (target: down and trending).

• Nth‑tier exposure coverage: percent of spend with resolved global ultimate and tier‑2 mappings.

• Audit‑ready evidence completeness rate and rework hours avoided.

Security, compliance, and continuity

• Data integrity: Parakeet enforces audit trails, versioned evidence packets, and role‑based access (Features).

• Business continuity: CRI integrates with incident and continuity workflows to maintain audit readiness during disruptions (Compliance Continuity).

Related Parakeet resources

• Supply chain resilience for manufacturers: Manufacturing

• End‑to‑end integrations catalog: Integrations

• Evidence packet automation: Google Docs integration

• Tasking and team execution: Trello, Slack, Microsoft Teams, Google Calendar

External references (vendor documentation)

• SecurityScorecard daily scoring updates and webhooks: How SecurityScorecard calculates your scores; Rule Builder: Webhooks.

• EcoVadis methodology, API, evidence basis, and reassessment cadence: Ratings Methodology Overview and Principles; What is EcoVadis API; Reassessment credits and annual cadence; Supporting documents validity and evidence requirements.

• Dun & Bradstreet identity/linkage and monitoring cadence: Corporate Linkage APIs; Monitoring (Immediate/Hourly/Daily/Weekly/Monthly) and change notices.

Notes: This reference is current as of November 11, 2025. Confirm feature availability and SLAs with each vendor before go‑live.