Define the dependency
Identify critical services, access rights, personal data and the teams responsible for the relationship.
Third-party risk advisory
Review the suppliers your business depends on.
Prioritise suppliers by the access they hold, the data they handle and the operational impact of losing their services.
Does the supplier certificate cover payroll hosting?
A payroll supplier’s certificate lists its head office. The business depends on a hosting service whose coverage is unclear.
Illustrative supplier review
- Dependency
- A hosting outage could delay the pay run. Establish which service, location and period the certificate actually covers.
- Owner
- The payroll owner requests evidence for hosting and recovery arrangements.
- Renewal
- Procurement records the answer, decision owner and review date before renewal. Escalate the remaining gap to the person authorised to accept it.
Engagement scope
Focus the supplier review
Check what the evidence covers
Confirm that a supplier report or certificate covers the service, locations and period you depend on. Record unresolved gaps, who owns the decision and any conditions on onboarding or renewal.
Agree the next decision
Set owners for remediation or risk acceptance, define review dates and consider what would trigger an earlier reassessment.
Which supplier would cause the most disruption if its service stopped?
Review supplier risk ↗