Supplier management II: performance, risk and multi-supplier services

A signed contract is a promise; supplier management turns it into delivery. This lesson covers how to measure and review supplier performance with scorecards, how to improve it, how to assess and manage supplier risk, what independent assurance reports such as SOC 2 do and do not tell you, how regulation shapes third-party risk management, and how to make several suppliers work as one service through service integration and management (SIAM). ITIL-130 lesson 11 introduced the SIAM layers and concentration risk; here we focus on how they work day to day.

Measuring supplier performance

Supplier performance is measured against the service levels and KPIs in the contract, supplemented by the organization's own experience. Contract measures typically include availability, response and resolution times, delivery dates, defect rates and reporting timeliness. Experience measures capture what the contract may miss: how easy the supplier is to work with, how quickly they escalate, how honest their reporting is, whether they propose improvements and how their staff behave in a crisis.

Organizations should not rely solely on the supplier's own reports. Where possible, LTS measures critical supplier services independently, for example with synthetic transactions through the network carrier's links and its own monitoring of cloud services. When the supplier's report and the organization's measurements disagree, the difference must be investigated before the review, not argued about during it.

Supplier scorecards

A supplier scorecard brings these measures together for review. Each measure is scored against its target, often on a simple scale or as a percentage, and weighted according to its importance. Scorecards make trends visible, allow fair comparison over time and give structure to review meetings. They should be shared with suppliers in advance; a scorecard that surprises a supplier in a meeting damages trust.

# Quarterly supplier scorecards: weighted score and trend for each supplier (invented data)
weights = {"service levels": 0.35, "quality": 0.20, "responsiveness": 0.15,
           "relationship": 0.15, "security": 0.15}
# scores out of 100 for the last three quarters
data = {
    "Network carrier": {"service levels": [92, 88, 81], "quality": [85, 80, 74], "responsiveness": [70, 68, 60],
                        "relationship": [75, 72, 65], "security": [88, 88, 86]},
    "Managed security": {"service levels": [84, 88, 91], "quality": [80, 83, 87], "responsiveness": [90, 92, 93],
                         "relationship": [82, 85, 88], "security": [95, 95, 96]},
    "Laptop repair":    {"service levels": [78, 79, 77], "quality": [82, 80, 81], "responsiveness": [75, 74, 76],
                         "relationship": [80, 80, 79], "security": [70, 72, 71]},
}
for sup, m in data.items():
    q = [sum(weights[k] * m[k][i] for k in weights) for i in range(3)]
    trend = q[2] - q[0]
    status = "improvement plan" if q[2] < 75 or trend < -5 else ("watch" if trend < 0 else "good")
    print(f"{sup:<18} Q1 {q[0]:5.1f}  Q2 {q[1]:5.1f}  Q3 {q[2]:5.1f}  trend {trend:+5.1f}  -> {status}")

Network carrier    Q1  84.1  Q2  81.0  Q3  74.8  trend  -9.3  -> improvement plan
Managed security   Q1  85.5  Q2  88.2  Q3  90.8  trend  +5.3  -> good
Laptop repair      Q1  77.5  Q2  77.5  Q3  77.0  trend  -0.4  -> watch

The network carrier's weighted score has fallen by more than nine points over three quarters, with service levels, quality and responsiveness all declining. Even though its latest score is only just below 75, the trend alone justifies a supplier improvement plan. The managed security provider is improving steadily; the laptop repair supplier is stable but its security score deserves a closer look.

Supplier reviews and improvement

Reviews happen at different levels. Operational reviews, often monthly, look at incidents, requests, changes and service levels. Tactical reviews, often quarterly, look at scorecards, trends, risks, improvement plans and contract issues. Strategic reviews, often annual for strategic suppliers, look at the relationship as a whole: shared goals, roadmaps, innovation and the future of the contract. The level of formality should match the supplier tier.

When performance falls short, a supplier improvement plan sets out the problem, causes, actions, owners, dates and measures, much like the service improvement plan in lesson 3. Most performance problems are resolved through such plans and honest conversation. Contractual remedies, such as service credits, withholding payment or ultimately termination, are tools of last resort, because they damage the relationship and rarely improve the service quickly. For strategic suppliers especially, the aim is joint improvement: both sides may need to change, for example by sharing better forecasts or simplifying handoffs.

Supplier risk

Every supplier introduces risk. Risks include service failure, financial failure of the supplier, security breaches, privacy violations, regulatory non-compliance, concentration on one supplier, geopolitical events affecting supply, loss of key supplier staff, fourth-party failures and lock-in that makes exit difficult. Supplier risk management identifies these risks for each supplier, assesses their likelihood and impact, and decides how to treat them: accept, reduce, transfer through contracts or insurance, or avoid by not using the supplier.

A common technique is to tier suppliers by inherent risk before contracting, based on the criticality of the services they support and the sensitivity of the data they handle, and then to set the depth of due diligence and monitoring by tier. Residual risk, the risk remaining after controls, is then reviewed periodically.

# Inherent supplier risk tiering from criticality, data sensitivity and substitutability
suppliers = [
    # name, service criticality (1-5), data sensitivity (1-5), difficulty to replace (1-5)
    ("Cloud provider", 5, 4, 5),
    ("WMS vendor", 5, 3, 5),
    ("Managed security provider", 4, 5, 3),
    ("Network carrier", 5, 2, 3),
    ("Payroll SaaS", 3, 5, 3),
    ("Laptop repair", 2, 3, 1),
    ("Printer maintenance", 2, 1, 1),
]

def tier(c, d, r):
    score = 0.4 * c + 0.35 * d + 0.25 * r
    if score >= 4.0 or (c == 5 and r == 5):
        return score, "tier 1: deep due diligence, annual assurance review, exit plan"
    if score >= 3.0:
        return score, "tier 2: standard due diligence, assurance every 2 years"
    return score, "tier 3: light checks at contract and renewal"

for name, c, d, r in sorted(suppliers, key=lambda s: -(0.4 * s[1] + 0.35 * s[2] + 0.25 * s[3])):
    s, t = tier(c, d, r)
    print(f"{name:<26} score {s:4.2f}  {t}")

Cloud provider             score 4.65  tier 1: deep due diligence, annual assurance review, exit plan
WMS vendor                 score 4.30  tier 1: deep due diligence, annual assurance review, exit plan
Managed security provider  score 4.10  tier 1: deep due diligence, annual assurance review, exit plan
Payroll SaaS               score 3.70  tier 2: standard due diligence, assurance every 2 years
Network carrier            score 3.45  tier 2: standard due diligence, assurance every 2 years
Laptop repair              score 2.10  tier 3: light checks at contract and renewal
Printer maintenance        score 1.40  tier 3: light checks at contract and renewal

Independent assurance reports

Organizations cannot audit every supplier themselves, so they rely on independent assurance. A SOC 2 report, prepared by an independent auditor under standards set by the AICPA, describes a service organization's controls relevant to security, availability, processing integrity, confidentiality and privacy. A Type I report assesses whether controls are suitably designed at a point in time; a Type II report also tests whether they operated effectively over a period, usually six to twelve months, and is far more useful. SOC 1 reports cover controls relevant to customers' financial reporting. In Canada, the equivalent assurance standards are issued under CPA Canada's handbook, and many Canadian organizations accept SOC reports as well. ISO/IEC 27001 certification shows that an organization operates an information security management system audited by a certification body.

These reports are valuable but must be read, not just collected. Reviewers should check the scope (does it cover the services and locations used?), the period, any exceptions found by the auditor, the complementary user entity controls the customer must operate itself, and the carve-outs for subservice organizations such as the supplier's own cloud provider. A SOC 2 report that excludes the very data centre hosting your service gives little assurance about it.

Regulation of third-party risk

Regulators increasingly expect organizations to manage third-party risk formally. For federally regulated financial institutions, OSFI Guideline B-10, Third-Party Risk Management, published in April 2023 and effective from May 2024, expects institutions to identify and assess risks before entering arrangements, apply more scrutiny to higher-risk and critical arrangements, include specific provisions in contracts such as audit and information rights and breach notification, monitor arrangements continuously, plan for exit and consider concentration risk across the institution. Guideline B-13 on technology and cyber risk applies alongside it. For cloud services used by the federal government, the Canadian Centre for Cyber Security assesses cloud providers' security controls, and departments must apply the Government of Canada cloud guardrails. Other sectors face their own expectations, such as provincial health privacy laws for suppliers handling health information.

These rules differ in detail, but they share a common shape: know your suppliers, assess risk before contracting, contract for the rights you need, monitor continuously, plan for exit and watch concentration. That shape is good practice for any organization, regulated or not.

Concentration and fourth-party risk

Concentration risk arises when many critical services depend on one supplier, or when many suppliers depend on the same fourth party. ITIL-130 discussed concentration at the level of the value system. In supplier management, the practical task is to map dependencies: which critical services rely on which suppliers, and which suppliers rely on the same underlying providers. A CMDB that records supplier relationships, as described in lesson 4, makes this much easier. Larchmont discovered, for example, that its managed security provider, its payroll software and its shipment portal all ran in the same cloud region, so a regional outage would affect all three at once.

Multi-supplier services and SIAM in practice

When a service depends on several suppliers, someone must make them work together. ITIL-130 described the SIAM layers: the customer organization, the service integrator and the service providers. In daily operation, SIAM relies on a governance structure of boards and forums. Strategic boards, with executives from the customer, integrator and key providers, set direction. Tactical boards review performance, risks and improvements across suppliers. Operational forums, often called process forums or working groups, bring practitioners from all suppliers together around a process such as incident or change management, so that procedures, tools and data work across organizational boundaries.

The integrator, whether an internal team or an external company, owns end-to-end service levels, coordinates cross-supplier incidents and changes, maintains a shared service management toolset or integrations between suppliers' tools, produces end-to-end reporting and leads collaborative improvement. Contracts with providers should include collaboration obligations: taking part in forums, sharing data, following common processes and accepting the integrator's coordination role even though the integrator is not a party to each provider's contract.

Exit and transition

Every contract ends eventually. ITIL-130 introduced exit planning; supplier management keeps exit plans current for strategic and tactical suppliers. A practical exit plan lists the services and data to be transferred, the knowledge and documentation needed, the assistance the supplier must provide, the timeline, the costs and the risks, and identifies alternative suppliers or an in-house option. It should be tested in part, for example by checking that data can actually be exported in a usable format.

Measuring the practice

Measures for supplier management include the share of suppliers with a named owner and current contract record; the share of critical suppliers with current scorecards, risk assessments, assurance reviews and exit plans; supplier performance trends; the number of renewal deadlines missed; savings achieved through negotiation; and stakeholder satisfaction with supplier-delivered services.