Third-party risk, end to end
Most published "supplier risk" frameworks stop at onboarding: verify who the supplier is, tick the box, move on. The harder and more valuable part is everything that happens after the contract is signed. This is the full lifecycle, from first contact to exit, with a working tool at each stage.
My earlier framework, OSINT Supplier Verification, is a due-diligence tool: it answers "is this supplier who and what they claim to be, right now?" That question matters, but it is one stage of a much longer relationship. A supplier can pass verification cleanly and still become the source of a serious incident eighteen months later, when its ownership changes, its financial position deteriorates, or it quietly subcontracts a critical process to a fourth party nobody screened.
The discipline that manages that risk is a lifecycle: onboarding, risk classification, due diligence, contractual controls, ongoing monitoring, incident management, remediation, and exit or replacement. Miss a stage and the earlier ones stop protecting the organisation, because unmonitored risk is unmanaged risk, however good the initial check was.
What follows is that lifecycle, generalised from the same instinct that runs through the physical-asset work elsewhere on this site: a record is only as good as the last time someone checked it against reality. Every example below is generic. Nothing here describes any particular organisation's suppliers, contracts or incidents.
The Lifecycle
Eight stages, one continuous disciplineOnboarding
Before a supplier is engaged, there is a narrow window to check what they say about themselves against what is independently verifiable. This is the intake gate: the point where it is still cheap to say no.
Tool: Intake Record
- Legal entity and beneficial ownership confirmed against a company registry, not just the name on the invoice
- Sanctions, export control and politically-exposed-person screening, with the screening date recorded
- Basic financial health snapshot: filed accounts, credit rating, any insolvency or winding-up markers
- Certifications and insurance claimed, verified against the issuing body rather than a supplied PDF
- A named internal owner before the relationship starts
Risk Classification
Not every supplier deserves the same scrutiny, and treating them all identically wastes effort on low-risk relationships while under-resourcing the ones that could hurt the organisation. Classification sets how hard everything downstream has to work.
Tool: Segmentation Matrix
| Tier | Criteria | Downstream treatment |
|---|---|---|
| Critical | No ready substitute, high spend, access to sensitive data or safety-relevant supply | Full due diligence, continuous monitoring, board-visible risk register entry |
| Significant | Moderate substitutability, meaningful spend or operational dependency | Standard due diligence, scheduled periodic review |
| Standard | Readily substitutable, limited data access, moderate spend | Light-touch due diligence, annual re-screen |
| Low | Commodity supply, negligible data access or operational dependency | Baseline screening only, exception-based review |
Due Diligence
Depth scales with tier. A Critical supplier gets every category below. A Low-tier one might only need the first two. The point of scaling it is to protect the credibility of the check itself: due diligence that is applied uniformly and shallowly to everyone ends up meaning nothing for the suppliers that matter.
Tool: Due-Diligence Checklist (by category)
- Corporate structure and beneficial ownership, including ultimate parent
- Financial stability: liquidity, debt position, trend over the last three reporting periods
- Compliance history: litigation, regulatory action, adverse media
- Cyber and information security posture, proportionate to data access granted
- Business continuity and disaster recovery capability
- Fourth-party visibility: who the supplier itself depends on, and whether that has been disclosed
- ESG and labour standards, where relevant to sector and jurisdiction
- Insurance adequacy against the value and risk of the relationship
Contractual Controls
Due diligence findings that are not written into the contract remain opinions. This is where risk assessment becomes enforceable.
Tool: Clause Checklist
- Right-to-audit, with a realistic notice period rather than one nobody will ever use
- Defined SLAs and KPIs, with a measurement method both sides agree on before a dispute happens
- Notification obligations: change of control, insolvency risk, security incident, subcontracting
- Data protection and security schedule, scoped to what is shared
- Business continuity and disaster recovery requirements, not just an aspiration clause
- Termination triggers tied directly to the due-diligence findings that would have failed the supplier at intake
Ongoing Monitoring
A due-diligence check is a photograph. Monitoring shows that the picture is out of date before something breaks because of it. Cadence should follow the tier set in stage two, with no single fixed calendar for everyone.
Tool: Key Risk Indicators (sample)
- Financial health score movement beyond an agreed threshold
- Delivery or service performance trend against the contracted SLA
- Adverse media or litigation alert, screened on a cadence matched to tier
- Sanctions and watch-list re-screening, continuous for Critical, periodic below that
- Security posture change: a new breach disclosure, a lapsed certification, a failed audit elsewhere
Incident Management
When a monitoring trigger fires, or something goes wrong that monitoring did not catch, the organisation needs to already know how seriously to take it and who decides. Working that out for the first time during the incident is how a minor issue becomes a major one.
Tool: Severity Ladder
| Severity | Example trigger | Response |
|---|---|---|
| Minor | Isolated SLA breach, no downstream impact | Logged, tracked, reviewed at next scheduled check-in |
| Moderate | Repeated breach, or a single breach with limited downstream effect | Formal notice to supplier, corrective action plan required |
| Major | Service disruption reaching customers or operations | Escalation to risk owner, contingency supply activated if available |
| Critical | Safety, security or regulatory breach | Immediate escalation to senior leadership, contract suspension considered |
Remediation
An incident closed without a corrective action plan is a repeat incident waiting to happen. Remediation is where the organisation decides whether the relationship is worth continuing to invest in fixing, and proves it with evidence rather than a promise.
Tool: Remediation Tracker Fields
- Root cause, categorised (process failure, capacity, financial distress, fourth-party failure, other)
- Named corrective actions, each with an owner and a date, not a general commitment to "do better"
- Verification method: how closure will be evidenced, and by whom other than the supplier itself
- Re-assessment of risk tier once actions are verified closed, since a remediated supplier is not automatically back to its original rating
Exit or Replacement
Every supplier relationship ends eventually, on someone's terms. The difference between a controlled exit and a crisis is almost entirely a matter of whether the organisation planned the transition before it needed one.
Tool: Exit Triggers and Transition Checklist
- Trigger criteria defined in advance: persistent non-compliance, unacceptable residual risk, business failure, strategic change
- A dual-running or transition period long enough to qualify a replacement without a capability gap
- Data return or destruction confirmed, not assumed
- Knowledge transfer captured before the relationship ends, not reconstructed afterwards from memory
- Lessons from the exit fed back into stage two's segmentation criteria, so the next supplier in that category is classified better
Limits of this framework
This is a working structure with no certification or claim of conformity to any specific regulatory regime. Real programmes borrow from ISO 31000, ISO 28000, COSO and sector-specific rules, and the right version of each tool above depends on jurisdiction, sector and the specific risk appetite of the organisation running it.
Judgement remains necessary. A checklist sets out what to check. It leaves open what to do when a Critical supplier fails one item and passes everything else. That decision is still a human one, and the framework's job is to make sure the decision gets made with full information, on a known schedule, rather than by accident when something has already gone wrong.
Where this comes from
Every stage above has a direct equivalent in physical asset and supply chain assurance: onboarding is a supersession check, classification is knowing which accounts carry real financial exposure, monitoring is a stocktake cycle, incident management is what happens when a discrepancy is found, and exit is a formal handover. The vocabulary is corporate. The underlying discipline is the same one built into eighteen years of Defence logistics: checking what is claimed against what is true, on a schedule, with someone accountable for the gap. See Same Control, Two Vocabularies for that mapping in more detail.