Skip to content

Supply Chain & Resilience

Governance framework

What this is

A third-party risk governance framework defines how an organisation makes and records decisions about supplier risk on an ongoing basis. It sets out roles and decision rights, the thresholds that trigger assessment, the route for accepting residual risk, and the reporting that gives leadership a current position rather than a historical one.

The problem

The assessment programme finishes. Then what.

Supplier assurance programmes have an ending problem. A team assesses the critical suppliers, produces findings, closes what can be closed, and the programme concludes. Twelve months later the register is stale, three new critical suppliers have been onboarded without assessment, and two assessed ones have changed materially. The work was real and it did not persist.

It did not persist because nothing was built to carry it. There is no threshold that triggers assessment when procurement onboards someone, no owner for the register, no route to accept a residual risk that produces a record, and no reporting that would have shown leadership the position drifting.

The framework is the boring answer and it is what makes the difference between a programme and a capability. It is also what a regulator asks for: DORA and NIS2 both look for ongoing oversight of critical providers, which is a governance question rather than an assessment question.

Who this is for

  • Organisations who have completed a supplier assessment programme and want it to persist.
  • Companies where new suppliers are onboarded without any security trigger.
  • Regulated firms who must demonstrate ongoing oversight rather than a point-in-time review.
  • Teams where supplier risk decisions are made informally and not recorded.
  • Boards asking for a current view of third-party exposure and receiving last year's assessment.

Delivery

How the engagement actually runs

Sprints inside your engineering cycle, with findings arriving continuously rather than a report arriving at the end. Durations are elapsed time for a typical scope, and get re-scoped against your estate before anything is committed.

  1. 011 week

    Map current decisions

    How supplier decisions are actually made today, which is usually informally and by whoever is closest to the contract.

  2. 021-2 weeks

    Design the model

    Roles, thresholds, decision rights and acceptance route, designed against your procurement process rather than a generic model.

  3. 031-2 weeks

    Wire it in

    Triggers connected to procurement onboarding and contract renewal, so assessment fires without anyone remembering to start it.

  4. 042 weeks

    First reporting cycle

    Produce the first leadership report, which is where the gaps in the register become visible and get owned.

Deliverables

What you actually receive

Artefacts your team owns and can maintain after the engagement, not a report that ages the moment it lands.

Deliverables for Governance framework, with what each one contains and when it lands
DeliverableWhat it containsWhen
Roles and decision rightsWho assesses, who approves, who can accept residual risk and at what level - with the authority written down rather than assumed.Week 2
Assessment triggers and thresholdsWhat causes an assessment: onboarding above a tier, a material change, a supplier incident, a certificate expiry. Wired into procurement so it fires automatically.Week 3
Risk acceptance routeHow a residual risk is accepted, by whom, with what expiry and what review - so acceptance is a recorded decision rather than an absence of one.Week 3
Register ownershipA named owner, a maintenance cadence and a definition of what 'current' means, because a register without an owner is a document.Week 4
Reporting packA recurring view for leadership: tier 1 coverage, assessments due and overdue, open findings by age, and accepted risks approaching expiry.Week 4
Escalation pathWhat happens when a critical supplier fails an assessment or has an incident, and who decides whether to continue with them.Week 4

Frameworks this touches

FAQ

Questions people actually ask

What should trigger a supplier security assessment?

Onboarding above a defined criticality threshold, contract renewal for tier 1, a material change in the service or the data it touches, a change of ownership at the supplier, a security incident at the supplier, expiry of a certification they relied on, and a sub-processor change. The triggers should sit inside the procurement and contract processes so they fire automatically, rather than depending on someone remembering.

Who should be able to accept third-party risk?

Acceptance authority should scale with the risk. A low-tier supplier with a minor finding can be accepted by the service owner; a critical supplier with a material gap should require executive or board-level acceptance. What matters more than the specific levels is that acceptance produces a record - named person, date, rationale and expiry - because an accepted risk with no expiry becomes a permanent one nobody revisits.

What should leadership see about supplier risk?

Four things, and no heat map. Coverage: what proportion of tier 1 has a current assessment. Ageing: open findings by how long they have been open. Exceptions: accepted risks, by whom, and which are approaching expiry. And movement: what changed since the last report. That is a position a board can act on, which a maturity score is not.

How does this differ from the assessment programme itself?

The assessment programme is a project with an end date that produces findings about your current suppliers. The governance framework is the operating model that keeps it true afterwards - it decides what triggers the next assessment, who owns the register, how a risk gets accepted and what leadership sees. Running the programme without the framework produces work that decays; running the framework without the programme produces process with nothing in it.

More in Supply Chain & Resilience

Start

Three ways in, depending on how close the deadline is.

Or just email a human: hello@cloudgap.ai

We reply within24 hours