Template draft. Replace everything in [square brackets] with your own decision,
delete what does not describe what you really do, and approve it through your own document control. It is not legal
advice and does not make an organisation compliant or certified.
1. Introduction
Services are rarely delivered by one team alone. Hosting, connectivity, software licences, specialist engineers and shared internal groups all contribute, and a failure in any of them reaches the customer as a failure of the Organisation. This procedure applies one controlled way of working to every party that supplies something a service depends on, whether the party is outside the Organisation or another internal group.
It implements the supplier management process of the service management system. Information security requirements for suppliers are set in the Supplier Relationship Management Policy and the Supplier Relationship Management Procedure; this procedure adds the service view: commitments, performance, review and change.
2. Purpose
The purpose is to make sure that every supplier contributing to a service is chosen on evidence, bound by an agreement that supports the commitments made to customers, monitored against measurable targets, reviewed on a fixed rhythm, and exited in an orderly way when the arrangement ends.
3. Objectives
- Every supplier of a service component is recorded in the supplier register with a named owner and a tier, within [5 working days] of contract signature or start of supply.
- No supplier of a tier 1 or tier 2 component starts work without a signed agreement that covers the items in the contract content table.
- Supplier targets are never weaker than the customer targets they support, or the gap is accepted in writing by the service owner.
- Performance of every tier 1 supplier is measured monthly and of every tier 2 supplier quarterly, and reviewed with the supplier.
- Disputes are escalated and closed within the times in the dispute table, and no dispute is left open without an owner.
- Every supplier exit has a plan covering data return, access removal, knowledge transfer and replacement before notice is served.
4. Scope
- In scope: external suppliers of infrastructure, cloud and hosting services, network and connectivity, software and licences, managed services, contractors and consultants who operate or support a service, and any lead supplier that manages other suppliers on the Organisation's behalf.
- In scope: internal suppliers, meaning any group inside the Organisation that is not the owner of the service but supplies a component of it, such as a shared platform team, facilities or human resources for onboarding. These are governed through operational level agreements.
- In scope: the whole supplier life cycle from need identification to exit.
- Out of scope: the customer's own agreements with its own suppliers, and purchases that do not support a service (for example office stationery).
- Applies to: supplier manager, service owners, procurement, legal, finance, information security and every person who requests or manages a supplier.
5. Terms and definitions
| Term | Meaning |
|---|
| External supplier | A party outside the Organisation that provides a service, a component or a resource used in delivering a service. |
| Internal supplier | A group inside the Organisation, outside the service owner's own team, that provides a component of a service under an operational level agreement. |
| Lead supplier | An external supplier that manages one or more subcontractors and is answerable to the Organisation for the combined result. |
| Subcontractor | A party engaged by a lead supplier. The Organisation has no direct contract with it. |
| Underpinning contract | A contract with an external supplier whose targets support one or more service level agreements. |
| Operational level agreement | A documented agreement between the service owner and an internal supplier, with targets and responsibilities. |
| Supplier tier | A grade from 1 to 3 that decides how closely the supplier is governed, based on how much the services depend on it. |
| Supplier owner | The named person in the Organisation who manages the day to day relationship with one supplier. |
6. Roles and Responsibilities
| Role | Responsibilities |
|---|
| Process owner | Owns this procedure, approves changes to it, sponsors the supplier review programme and resolves disputes that the supplier manager cannot settle. |
| Supplier manager | Runs the process, keeps the supplier register and scorecards, chairs the supplier reviews, and reports supplier performance each month. |
| Supplier owner | Manages one supplier day to day, raises performance concerns, approves invoices against delivery, and keeps contact details current. |
| Service owner | States the requirement a supplier must meet, accepts or rejects gaps between customer and supplier targets, and takes part in reviews. |
| Procurement | Runs the selection exercise, issues requests for proposal, negotiates commercial terms and holds the signed agreement. |
| Legal adviser | Reviews contract clauses, liability, termination and data protection terms, and advises on disputes. |
| Information security | Assesses supplier security and privacy risk, sets security requirements and checks evidence before onboarding and at review. |
| Finance | Confirms budget, validates invoices and service credits, and reports the spend per supplier. |
| Top management | Approves tier 1 suppliers, supports escalation at executive level and receives the supplier summary at management review. |
| Activity | Responsible | Accountable | Consulted | Informed |
|---|
| Maintain supplier register | Supplier manager | Process owner | Supplier owner | Service owner |
| Assess and select a supplier | Procurement | Service owner | Information security, Legal adviser | Supplier manager |
| Agree and sign contract | Legal adviser | Process owner | Service owner, Finance | Supplier manager |
| Agree operational level agreement | Service owner | Process owner | Supplier manager | Service desk |
| Monitor supplier performance | Supplier owner | Supplier manager | Service owner | Customer representative |
| Hold supplier review | Supplier manager | Process owner | Supplier owner, Service owner | Top management |
| Resolve dispute | Supplier manager | Process owner | Legal adviser, Finance | Top management |
| Plan and complete supplier exit | Supplier owner | Service owner | Information security, Procurement | Supplier manager |
7. Supplier Management Process
7.1 Inputs and outputs
| Inputs | Outputs |
|---|
| Service requirements and customer targets from the service level management process | Updated supplier register with owner, tier and contract dates |
| Service catalogue entries and their dependencies | Signed underpinning contracts and operational level agreements |
| Supplier proposals, due diligence answers and security evidence | Supplier scorecards, review minutes and action lists |
| Incident, problem and change records that involve a supplier | Dispute records and their resolution |
| Invoices, service credit claims and usage reports | Supplier exit plans and closure reports |
| Business continuity and availability requirements | Supplier section of the monthly service report |
7.2 Process flow
- A need for a supplier is identified by a service owner, a project or a change, and recorded as a supplier request.
- The supplier manager assigns a tier and opens or updates the register entry.
- Procurement and the service owner run selection and due diligence.
- Contract or operational level agreement is drafted, reviewed, and signed by the authorised person.
- Onboarding is completed: contacts, access, escalation path, reporting schedule.
- Performance is measured against targets and recorded in the scorecard.
- Review meetings are held at the frequency set for the tier and actions are tracked.
- Changes, renewals and disputes are handled through the rules below.
- When the arrangement ends, the exit plan is executed and the register entry is closed.
7.3 Supplier tiers
The supplier manager assigns a tier when a supplier is first recorded and reconsiders it at each annual review or when the dependence of a service changes. The highest tier that any criterion reaches is used.
| Tier | Criteria | Governance |
|---|
| Tier 1: critical | Failure stops a service for more than [4 hours], or the supplier handles customer data, or the contract value is above [the tier 1 value threshold]. | Executive sponsor, monthly review, annual on-site or remote audit, exit plan before signature. |
| Tier 2: important | Failure degrades a service or can be worked around within [1 working day]; contract value above [the tier 2 value threshold]. | Quarterly review, annual questionnaire, exit plan within [90 days] of signature. |
| Tier 3: standard | Replaceable within [30 days] with no measurable customer impact. | Annual check of the register entry and contract renewal date. |
| Internal | Any internal group supplying a component of a service. | Operational level agreement reviewed every [6 months]; included in service reports. |
7.4 Selection and onboarding of external suppliers
- Define the needThe service owner writes the requirement: what is needed, the service levels it must support, volumes, security and data needs, and the budget. Output: supplier request. Owner: service owner. Target: [5 working days].
- Identify candidatesProcurement lists at least [3] candidates for tier 1 and tier 2 needs, or records why fewer are available. Owner: procurement. Target: [10 working days].
- EvaluateCandidates are scored against the weighted criteria below. Information security completes a security and privacy assessment; finance checks financial standing. Owner: procurement. Target: [15 working days].
- DecideThe service owner recommends one candidate. Approval is by the supplier manager for tier 3, the process owner for tier 2 and top management for tier 1. Output: signed decision record.
- ContractLegal adviser prepares the agreement from the Organisation's template and the contract content table. Output: signed agreement. Target: [20 working days].
- OnboardThe supplier owner collects named contacts, escalation path, reporting format and access needs; information security grants only the access the supplier needs. Output: completed onboarding checklist. Target: [5 working days] before service start.
- RegisterThe supplier manager completes the register entry and schedules reviews. Output: register entry. Target: [5 working days] after signature.
| Selection criterion | Typical weight | Evidence |
|---|
| Ability to meet the required service levels | [30%] | Reference sites, past performance data, proposed targets |
| Information security and privacy controls | [20%] | Questionnaire answers, independent audit reports or certificates the supplier holds, test of claims |
| Resilience and continuity arrangements | [15%] | Recovery objectives, location of facilities, tested plans |
| Commercial terms and total cost | [20%] | Priced proposal, exit and renewal costs, service credits |
| Financial standing and capacity to scale | [10%] | Accounts, customer concentration, staffing |
| Fit with the Organisation's way of working | [5%] | Demonstration, tooling, language and hours of support |
7.5 Contracts and agreements
A contract with an external supplier of tier 1 or tier 2 must make the supplier's commitments traceable to the commitments the Organisation makes to its customers. Where the supplier will not accept a clause, the legal adviser records the gap, the service owner accepts or rejects the risk in writing, and the register notes the exception.
| Contract content | Requirement |
|---|
| Scope of services | A description of what is supplied, to which services, locations and hours, with the supplier's responsibilities and the Organisation's responsibilities stated separately. |
| Service levels | Measurable targets for availability, response, resolution and delivery, a measurement method, a reporting frequency and service credits or remedies for a miss. |
| Authorities and contacts | Named roles with authority to make decisions, an escalation path with time limits, and a duty to keep contacts current. |
| Information security and privacy | Requirements from the Supplier Relationship Management Policy, a duty to report security incidents within [24 hours] or any shorter period the customer needs, and data handling and return terms. |
| Change and subcontracting | Notice of at least [30 days] of material changes; no subcontracting of a critical part without consent; flow-down of these terms. |
| Continuity | Recovery objectives that support the Organisation's continuity plan, test rights and notice of plan changes. |
| Audit and information | Right to review evidence of performance and controls, at least once a [year], with reasonable notice. |
| Term, renewal and exit | Term, renewal notice period of [90 days], termination for cause and convenience, exit assistance, return and deletion of data, and transfer of knowledge. |
| Disputes and law | The dispute steps in this procedure, governing law and jurisdiction chosen by legal adviser. |
Where a supplier processes personal data for the Organisation, the contract must also include the data processing terms that the Digital Personal Data Protection Act, 2023 and its Rules require [confirm the current requirement]. The legal adviser decides the text; the supplier manager checks it is present before signature.
7.6 Internal suppliers and operational level agreements
- Identify the dependencyWhile designing or changing a service, the service owner lists every internal group that supplies a component and records it in the supplier register as an internal supplier. Owner: service owner.
- Draft the agreementThe service owner and the internal supplier's manager draft an operational level agreement covering scope, hours, response and resolution targets, escalation and reporting. Target: [10 working days].
- Check alignmentThe supplier manager confirms that each internal target supports the customer target it underpins; a gap is resolved or accepted in writing by the service owner.
- SignBoth managers sign. The agreement is stored under document control with the review date.
- MeasurePerformance is taken from the ticketing tool and reported in the same scorecard form as an external supplier.
- ReviewThe agreement is reviewed every [6 months] or after a major incident caused by a missed target.
Note. An internal supplier is held to its operational level agreement exactly as an external supplier is held to its contract. Missed targets are escalated to the internal supplier's manager and, if not resolved, to the process owner.
7.7 Lead suppliers and subcontractors
- Where a lead supplier is used, the contract must state that the lead supplier is accountable for the performance of its subcontractors and for passing on the Organisation's requirements.
- The supplier manager obtains from the lead supplier the list of subcontractors that support each service, and the register notes them under the lead supplier. The list is refreshed at every review.
- The Organisation does not instruct a subcontractor directly except in an emergency declared under the critical incident process, and then informs the lead supplier at once.
- The supplier manager checks at each review that the lead supplier's own reviews of its subcontractors have taken place and that results reach the Organisation.
7.8 Monitoring supplier performance
- Collect dataThe supplier owner gathers measures from monitoring, the ticketing tool and supplier reports: availability, response, resolution, delivery on time, repeat faults, service credits claimed. Frequency: monthly for tier 1, quarterly for tier 2.
- Compare to targetsThe supplier manager compares results with contract targets and with the customer target they support and rates each measure green, amber or red using the scorecard.
- Test the supplier's own reportingFor tier 1 suppliers the supplier manager samples [5] incidents per quarter against supplier records to confirm the figures are accurate.
- Act on a missA red measure produces a written request for a cause and a recovery plan within [5 working days]. Two consecutive red months for the same measure moves the supplier to the formal improvement path in the dispute table.
- RecordThe completed scorecard is filed and its summary goes into the supplier section of the monthly service report.
| Measure | Typical target | Source | Frequency |
|---|
| Service availability supplied | [99.9%] a month | Monitoring tool and supplier report | Monthly |
| Response to priority 1 incident | [15 minutes] | Ticketing tool | Monthly |
| Resolution of priority 1 incident | [4 hours] | Ticketing tool | Monthly |
| Changes delivered on time | [95%] | Change records | Monthly |
| Invoices correct at first submission | [98%] | Finance records | Quarterly |
| Security incident notification within agreed time | [100%] | Incident records | Quarterly |
| Corrective actions closed on time | [90%] | Action list | Quarterly |
7.9 Supplier review meetings
Reviews are held at the frequency set by tier. Each review has an agenda issued [3 working days] before and minutes issued within [2 working days] after. Attendees are the supplier manager (chair), the supplier owner, the service owner or delegate, and the supplier's account manager and delivery lead.
| Item | Content |
|---|
| 1. Actions from last review | Status of each action, owner and date. |
| 2. Performance | Scorecard results, trends, service credits, major incidents attributed to the supplier. |
| 3. Changes | Planned and requested changes, releases, price changes, staff changes, subcontractor changes. |
| 4. Risks and security | Open risks, audit findings, security incidents, continuity test results. |
| 5. Commercial | Spend against budget, renewal date, volume forecasts. |
| 6. Improvement | Joint proposals for improvement and the customer feedback received. |
| 7. New actions | Owner, due date and priority for each action agreed. |
A tier 1 supplier also attends an annual strategic review with a member of top management, which looks at the relationship, roadmap, concentration risk and whether the supplier should remain.
7.10 Change, renewal and disputes
A change to a supplier's service, price or terms is requested in writing to the supplier owner, assessed by the supplier manager for impact on service commitments, and where it affects a service it is raised through the Change Management Procedure. A renewal review starts [120 days] before expiry and ends with a decision to renew, renegotiate, re-tender or exit.
| Stage | Action | Owner | Time limit |
|---|
| 1. Raise | The supplier owner states the issue to the supplier in writing, citing the contract clause and evidence. | Supplier owner | Within [2 working days] of discovery |
| 2. Operational resolution | Supplier owner and the supplier's delivery lead try to settle it. | Supplier owner | [5 working days] |
| 3. Management escalation | Supplier manager and the supplier's account manager meet and agree a written resolution or recovery plan. | Supplier manager | [10 working days] |
| 4. Executive escalation | Process owner and a director of the supplier decide; legal adviser attends. | Process owner | [15 working days] |
| 5. Formal remedy | Service credits, notice to remedy, or the dispute clause of the contract, on advice of the legal adviser. | Legal adviser | As the contract states |
7.11 Supplier exit
- DecideThe service owner proposes exit with reasons; the process owner or top management approves according to tier. Output: exit decision.
- PlanThe supplier owner prepares the exit plan: replacement or in-house plan, dates, data to be returned, access to be removed, knowledge transfer, effect on service levels and customer communication. Target: [30 days] before notice for tier 1.
- NotifyLegal adviser serves notice as the contract requires and agrees exit assistance.
- TransferData, documentation, licences and configuration records are handed over and checked. Changes are raised through change management. Owner: supplier owner.
- Remove accessInformation security removes every account, key, network path and physical pass of the supplier within [1 working day] of end of supply, and confirms in writing.
- Confirm data deletionThe supplier certifies that the Organisation's data has been returned and deleted by the agreed date.
- CloseFinal invoice and service credits settled, register entry set to closed, and lessons recorded in the improvement log. Owner: supplier manager.
8. Interfaces with other processes
| Process | Interface |
|---|
| Service level management | Supplier targets are checked against customer targets; supplier performance feeds service reports. |
| Service catalogue management | Supplier dependencies are recorded against each catalogue entry. |
| Business relationship management | Customer feedback about a supplied component goes to the supplier owner. |
| Change management | Changes at or by a supplier are raised, assessed and approved as changes. |
| Incident and problem management | Supplier-caused incidents are logged against the supplier and drive problem records and improvement requests. |
| Availability and service continuity management | Supplier recovery objectives are part of continuity plans and tests. |
| Information security management for services | Security requirements, assessments and incident reporting duties apply to suppliers. |
9. Key Performance Indicators
| Measure | Target | Source | Frequency |
|---|
| Suppliers in the register with owner, tier and contract dates complete | [100%] | Supplier register | Monthly |
| Tier 1 and tier 2 suppliers with signed agreement before start | [100%] | Register and contract store | Monthly |
| Scorecards completed on time | [95%] | Scorecard file | Monthly |
| Supplier reviews held as scheduled | [90%] | Review minutes | Quarterly |
| Review actions closed by the due date | [85%] | Action list | Quarterly |
| Contracts renewed or ended before expiry without gap | [100%] | Register | Quarterly |
| Disputes closed within the time limits | [90%] | Dispute log | Quarterly |
| Service targets missed because of a supplier | Fewer than [3] a quarter | Incident and service report | Quarterly |
10. Records and evidence
| Record | Kept in | Owner | Retention |
|---|
| Supplier register | Document management system | Supplier manager | Current version; history for [3 years] |
| Selection scores and decision record | Procurement file | Procurement | [Contract term plus 3 years] |
| Signed contracts and operational level agreements | Contract store | Legal adviser | [Contract term plus 6 years] |
| Scorecards and review minutes | Document management system | Supplier manager | [3 years] |
| Dispute records | Ticketing tool or case file | Supplier manager | [Contract term plus 6 years] |
| Exit plans, certificates of deletion and access removal evidence | Document management system | Supplier owner | [3 years] after exit |
Annexure A: Supplier register template
| Supplier | Type | Tier | Services supported | Supplier owner | Contract ref and dates | Service targets | Last review | Next review | Status |
|---|
| [Example Hosting Provider] | External | [1] | [Customer platform] | [Name] | [C-0001, 2026-01-01 to 2028-12-31] | [99.9% availability] | [date] | [date] | [Active] |
| [Shared platform team] | Internal | [Internal] | [Monitoring service] | [Name] | [OLA-0004, review 6 months] | [P1 response 15 minutes] | [date] | [date] | [Active] |
| | | | | | | | | |
| | | | | | | | | |
| Measure | Target | Result this period | Rating (green, amber, red) | Trend | Comment or action |
|---|
| Availability supplied | [99.9%] | | | | |
| Priority 1 response | [15 minutes] | | | | |
| Priority 1 resolution | [4 hours] | | | | |
| Changes on time | [95%] | | | | |
| Service credits claimed | [none] | | | | |
Annexure C: Supplier review minutes
| Field | Entry |
|---|
| Supplier and tier | |
| Date and attendees | |
| Period reviewed | |
| Performance summary | |
| Decisions | |
| Actions (owner, due date) | |
| Next review date | |
Annexure: Document history
| Version | Date | Author | Reviewed by | Approved by | Summary of change |
|---|
| [1.0] | [date of issue] | [Process manager] | [Process owner] | [Management representative] | Initial issue of SM10 |
| | | | | |
| | | | | |
11. Exception
Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.
12. Enforcement
Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.
13. Review
This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.
ISO/IEC 20000-1:2018 references
| Reference | Title |
|---|
| 8.3.4 | Supplier management |
| 8.3.3 | Service level management |
| 8.1 | Operational planning and control |
| 7.5 | Documented information |