Third-Party Risk & Supplier Assurance
Third-Party Risk & Supplier Assurance
A supplier list can look diversified and still fail from a single point, and paperwork can be complete while something underneath it has stopped adding up. Third-party risk and supplier assurance covers the external parties a business depends on, how concentrated that reliance is, and whether the evidence about them still matches what happens on the ground. The frameworks below cover the full supplier lifecycle, from onboarding and segmentation through to monitoring, verification and exit. They draw on my experience of real defence supply chains, and each is a starting point to adapt to a company's own risk appetite, regulatory environment and operating model.
Frameworks
See all ten →Three working frameworks, each with a tool at every stage rather than just a diagram.
Third-Party Risk, End to End
A full supplier lifecycle methodology, from onboarding through segmentation, due diligence, contractual controls and monitoring to incident management, remediation and exit, with a working tool at every stage.
Open the framework →One Register, Every Supplier
The schema, a worked example across four risk tiers, and a downloadable blank template: the single document that ties onboarding, monitoring and remediation together into one live view.
Open the framework →OSINT Supplier Verification
A seven-stage open-source verification sequence for the case where a supplier's paperwork is complete, its certifications are valid, and something has stopped adding up. Runs from corporate structure through to synthesis, with a confidence grading key and the legal constraints it operates under.
Open the framework →Related Writing
See all writing →
The Physical Assurance Gap in Third-Party Risk
Two 2026 KPMG surveys map where third-party risk management is putting its attention: data, AI, managed services. Physical verification barely appears in either, and the people already doing it have never been told that it counts.
For third-party-risk professionals: a practical way to find the physical dependencies that registers miss.
Read the essay →
Supplier Concentration Risk: Measuring It Tier by Tier
A supplier list with fifty names on it can still fail from a single point. How to measure the concentration that headcount hides, and what to do once you've found it.
For supplier-assurance and procurement risk teams: how to measure the concentration that a supplier count hides.
Read the essay →
The Convergence of Cyber-GRC and Physical Logistics
Why siloed supply chain assurance creates blind spots, where they form, and what happens to custody when nobody is holding the item.
For supply chain, trade compliance and GRC leaders: where cyber and physical assurance leave a gap between them.
Read the essay →Related Operational Evidence
Neither of these was a dedicated third-party risk engagement, but both demonstrate skills the discipline depends on: cross-organisational stakeholder coordination and systematic discrepancy investigation.
Building Fleet-Wide Inventory Visibility
Took over a predecessor's incomplete build and reconfigured the spreadsheet feeding it, creating a single source of truth for STOROB (cross-platform stock reallocation) tracking that identified an £8,000, 50-hour STOROB within days, was rolled out to an adjacent unit, and has since been adopted by inventory managers elsewhere in the fleet.
Read the case study →Identifying £2.4M in Misallocated Funds
Identified £2.4M in misallocated expenditure on an adjacent account through a review of annual inventory demands, the same investigative method a supplier financial-risk review depends on.
Read the case study →Get in touch
If third-party risk or supplier assurance is the gap your organisation is trying to close, I'd welcome a conversation now.
Request the Full CV: email your name, organisation and the role you're exploring, and I'll send it directly.