The Quiet Vendor: Testing Continuity Before a Critical Supplier Fails

Most boards discover the depth of a supplier relationship only when the supplier stops responding. A missed call, a delayed delivery, an unexplained change of account manager: these are small signals that can precede a much larger continuity event. For UK boards, the question is not whether a critical vendor might fail, but whether the organisation could keep operating while it does. Administration is rarely a single-day event. It is usually a sequence of warnings, some visible in public filings and others visible only in operational behaviour, before the issue reaches the boardroom.

The discipline required is straightforward but easily deferred. It begins with a critical-supplier register, moves through board-level questions designed to test the evidence behind continuity claims, and ends with a monthly routine that keeps exposure visible between formal audits. The purpose is not to predict insolvency. It is to shorten the period in which a board is guessing.

Start with dependency, not spend

Procurement categories rank suppliers by value. Continuity ranks them by consequence. A low-spend provider of a specialist component, a payroll bureau, a lone cloud hosting intermediary or a maintenance contractor with unique access can be more critical than a large professional-services firm. Boards should ask management to identify suppliers whose failure would stop a service, breach a regulatory obligation, compromise client data or prevent invoicing within a defined period.

The register should be short enough to be read. Ten to twenty entries are usually sufficient; if it runs to hundreds, the definition is too broad. Each entry should record the process or service supported, the internal owner, the degree of dependence, the time needed to qualify an alternative, contractual notice and exit assistance, data location and return arrangements, financial warning indicators, the named contingency owner and the trigger point at which the plan is invoked. A register without named owners is an inventory, not a control.

The questions that expose false comfort

Many continuity plans describe intentions rather than capabilities. The board's task is to test whether the plan would work without the supplier's cooperation. Useful questions include:

• If the supplier ceased responding today, which three processes would stop first, and who has authority to approve workarounds?
• Which alternative suppliers have been qualified in the past twelve months, rather than merely identified?
• What contractual right does the organisation have to step in, recover data or require transition assistance?
• Who at the supplier is the single point of failure, and what happens if that person leaves?
• What would be said to clients, regulators or insurers in the first 24 hours, and who approves that message?
• Has the plan been tested without the supplier's active participation?

An answer that relies on the supplier's willingness to help is not a contingency plan. Nor is a plan that depends on the same executive already managing the live relationship. Boards should look for evidence: a dated test, a named deputy, a contact route that does not run through a single account manager, and a decision log showing what changed after the last exercise.

Assign contingency ownership

Contingency ownership is not a committee. It should sit with a named executive who has authority to invoke the plan, commit spend within a pre-approved limit and escalate to the board. The owner should not always be the commercial relationship holder, whose incentives may favour preserving the supplier relationship over preparing for its failure. A separate owner creates useful tension.

The board should receive the owner's name, the date of the last test and the open actions at each scheduled review. Where a supplier is deeply embedded, the owner should also maintain a short transition file: key contacts, system access, data maps, contractual notices and the first three actions to be taken if the supplier fails. This file should be accessible without the supplier's assistance.

A 30-day review routine

Monthly review is appropriate for critical vendors. A practical routine has four parts. First, refresh the register using accounts, credit alerts, Companies House filings, service-level data, changes in account management and unusual payment requests. Second, review one dependency scenario in depth, rotating through the register so that every critical supplier is examined at least twice a year. Third, confirm that open actions have owners and dates. Fourth, prepare a one-page dashboard for the board showing critical vendors, dependency rating, last test, contingency owner, open actions and any trigger events.

The board's role is to challenge the evidence, not to re-underwrite every contract. A dashboard that shows only green ratings without test dates or named owners offers little assurance. A short red-amber-green summary supported by evidence is more useful than a lengthy report that repeats management's confidence.

When warning signs appear

Not every missed call is a crisis, but patterns matter. Boards should agree in advance which triggers require a contingency activation meeting within five working days. Triggers may include an abrupt change in payment terms, a request for deposits or accelerated payment, unexplained staff turnover in a key team, delayed accounts, a credit downgrade, repeated service failures, regulatory action or a change of insurer.

The aim is not to create a parallel procurement function. It is to ensure that the board can act before silence becomes a crisis. A critical-supplier register, a set of evidence-based questions and a monthly review routine give directors a proportionate way to test continuity without waiting for the next audit cycle.