Supplier assurance · One off or on a cycle
A supplier register tiered by what each one can actually touch, and an assessment of the ones that matter. A returned questionnaire is an assertion until something is examined, and we mark it as one.
Who this is for
Most third party programs assess whoever replies. That is how a stationery supplier gets assessed while the payroll provider with domain administrator rights does not.
The question is no longer whether you have a policy. It is which suppliers were assessed this period and what was found.
Nearshore and shared services operations carry their clients' obligations downward. Knowing your own suppliers is part of answering for yourself.
Every register surfaces at least one. They come from accounts payable and access records, not from the list the business maintains.
What it protects
Supplier assurance is bought for two reasons, and both are commercial before they are technical.
Customers increasingly ask what you do about your own suppliers, and a policy is no longer the answer. Count the revenue behind contracts carrying a supply chain clause. That is the number this protects.
Every register surfaces a supplier with live access and no current contract. That is an open door with no owner, and finding it is usually the cheapest risk reduction available in the engagement.
Underwriters and customers both ask which suppliers were assessed and when. A coverage position answers it. A list of suppliers does not.
The four stages
Contracts, accounts payable and access records, reconciled against each other. Suppliers with access and no contract surface here, and so do contracts nobody is paying for.
This is where the surprise usually is, and it is the cheapest stage.
Data held, systems accessed, and whether access ends when the contract does. That decides the tier, not the size of the invoice.
A supplier who can reach your identity provider outranks one who bills you more and holds nothing.
Questionnaires go out and come back as documents, tracked by who received them and when. No portal anybody has to log into, and no platform your suppliers have to be onboarded to.
Non response is recorded as non response. Treating silence as a pass is how a register becomes fiction.
For tier one, the assertion is checked against something. An attestation report read rather than filed, a certificate with its scope actually examined, a configuration export, a contract clause.
How tiers work
The register covers every supplier. How hard each is examined depends on what they can reach.
| Tier | Typically | What we do |
|---|---|---|
| One | Holds personal or regulated data, or can reach systems directly | Questionnaire, then evidence examined against it, findings raised, reassessed on a stated cycle. |
| Two | Holds limited data, or access is mediated and time bound | Questionnaire reviewed, contract terms checked, evidence requested only where an answer is inconsistent. |
| Three | No access to data or systems | Recorded in the register with the basis for the tier. Not assessed, and the register says so rather than leaving a blank. |
How we work with your team
Some supplier findings are contractual and some are technical. They go to the team that can fix them, separated, rather than as one list neither owns.
The conversation with a supplier is yours. We give you the finding and the clause it rests on, which makes that conversation shorter and considerably less awkward.
Tiering rules, questionnaire and cycle dates handed over, so your team can add a supplier next month without calling us.
What you end up with
What changes afterwards
For a customer, an underwriter or a board, from a register rather than an email search.
Starting with the suppliers who still have it and should not.
Tiering rules and a cycle your own team runs.
Boundaries
We establish the position and write the finding. The conversation with the supplier is yours, and it goes better when it cites a clause rather than a worry.
Recorded as non responsive, with the date and the attempts. That is a finding about your leverage, and it is often the most useful one in the report.
Your supplier's suppliers are in scope only where your contract gives you the right to ask. Where it does not, that absence is the finding.
Almost every organization can produce a supplier list from accounts payable in an afternoon. Comparing it against who holds an account in your systems costs nothing, and it is usually where the surprise is.