Take back control of the risk that comes from outside
Suppliers, technology partners, SaaS providers, subcontractors and group companies may have access to critical data, systems, know-how and processes. We help build a practical vendor compliance system: from a risk map, through onboarding and contractual clauses, to an incident-response model.
You can have well-organised internal processes and still carry risk through your counterparties.
In practice it is often a SaaS provider, software house, agency, integrator or outsourcing partner that processes data, runs systems, deploys AI or has access to information whose loss hits your organisation directly. Supplier risk does not stay with the supplier. It returns to the company: through data, cybersecurity, management-board accountability, business continuity and reputation.
The biggest problem usually does not sit in a single contract. It sits in the lack of a shared standard: who reviews the supplier, what questions they ask, when legal or security is involved, which risks can be accepted and which require a management-board decision. Without that, procurement works under time pressure, contracts lag behind technology, and the response to an incident on the partner’s side starts with improvisation.
Mateusz Sawaryn
Managing Partner Counsel
Our solution
We build a supplier-control system that works in day-to-day operations
This is not another procedure for the drawer. The aim is a simple, practical model used by procurement, IT, legal, security, operations and the management board. One that speeds up decisions, clarifies ownership and reduces the risk of external dependencies.
Map of supplier relationships and risks
- identification of suppliers, partners, subcontractors and group companies,
- definition of access to data, systems, know-how and critical processes,
- identification of risks: data, cyber, AI, confidentiality, business continuity, subcontracting, conflicts of interest,
- prioritisation of relationships that require action.
Supplier categorisation by risk level
- classification of relationships into low, medium and high risk,
- acceptance and escalation rules,
- thresholds for involving legal, IT/security, compliance and the management board,
- recommendations for periodic review.
Verification and onboarding standard
- questions for suppliers,
- list of required documents and statements,
- minimum criteria before cooperation begins,
- paths for low- and high-risk suppliers,
- how decisions are archived.
Compliance clauses for contracts
- personal data and party roles,
- cybersecurity and technical standards,
- AI and automation,
- confidentiality and trade secrets,
- subcontractors and further entrustment,
- audits, incident reporting and remedial action,
- liability, exit plan, return or deletion of data.
Checklists for business teams
- checklists for procurement, operations, IT/security and legal,
- “when to escalate” instructions,
- simplified paths for simple relationships,
- warning signs in conversations with the supplier.
everyday tools that reduce chaos and shorten the decision process.
Response model for breaches and non-compliance
- action path for an incident on the supplier’s side,
- templates for information and document requests,
- escalation to the right people,
- assessment of obligations toward clients, regulators and partners,
- documentation of decisions.
Linking vendor compliance to the company's risk policy
- embedding suppliers in the wider risk-management system,
- reporting rules for the management board,
- linking purchasing decisions to risk acceptance,
- recommendations for monitoring and updating the standard.
Who this service is for
For companies that work with suppliers who have a real impact on data, systems or business continuity
The service is especially useful where suppliers are no longer only counterparties, but part of the company’s infrastructure, processes or growth model.
Head of Procurement / Procurement Manager
when procurement needs clear supplier-assessment criteria, faster approval paths and fewer disputes at the end of the process.
General Counsel / Compliance Officer / Head of Legal
when responsibility, clauses, escalations and decision documentation in partner relationships need to be put in order.
CFO / COO / Board Member responsible for risk or operations
when the company wants control over external dependencies without blocking procurement, technology and growth.
Work stages
A simple process: from diagnosis to a working standard
We start with what is most risky and most urgent for the business. We avoid analysing everything at once unless that is needed. First we set priorities, then we design the standard and implement it where it must actually work.
Assess and prioritize
We gather information about supplier types, procurement, contracts, data and system access, and previous issues. We identify relationships that need attention first.
Design an operating standard
We define supplier categories, minimum requirements, onboarding checklists, escalation thresholds, document scope and recommended clauses.
Implement in contracts and processes
We apply the standard to real contracts, procurement and partner relationships, preparing clauses, templates, amendments, team guidance and a streamlined path for low-risk relationships.
Monitor, respond and improve
We support periodic reviews, update requirements, respond to incidents, negotiate, audit and adapt to regulatory changes and new technologies.
Write to us
Check which supplier risks need a decision now
One conversation is enough to determine whether you need a quick risk map, a clause package, an onboarding standard or a full partner-control system.
In the form we will ask about supplier types, risk areas, the number of relationships to organise and the most urgent context: a new implementation, an audit, an incident, expansion, a capital group or procurement chaos.
Mateusz Sawaryn
They will follow up with any questions or recommend a next step.
Quick response
We usually respond within two hours on business days.