Twenty-seven nations are likely to come up with 27 different definitions of vendor risk.
The European Union’s member nations are finding that out in real time. And while the long-standing debate around whether equipment from suppliers such as Huawei should sit inside critical communications infrastructure is nothing new, there is a more consequential problem for companies far beyond telecom: organizations can know exactly who they are buying from and still have surprisingly little idea whose technology they are buying.
A multinational can verify a supplier’s corporate registration, beneficial owners, sanctions exposure and bank account before approving an invoice. Yet that same company may have considerably less visibility into the cloud infrastructure, networking equipment, cybersecurity software, chips, subcontractors and embedded components sitting several layers beneath that supplier.
That blind spot is becoming harder to dismiss as a cybersecurity problem alone. Particularly as governments start to place greater scrutiny on technology origin, ownership and concentration, any supplier and provider information gaps could turn procurement decisions that once looked efficient into regulatory and financial liabilities.
Read more: Innovation Keeps Expanding Compliance for Mid-Market Firms
The Supplier on the Invoice Isn’t Always the Supplier That Matters
A new Royal United Services Institute (RUSI) analysis of how Germany, Spain and the United Kingdom handle high-risk ICT vendors highlights substantial differences in national approaches and calls for better visibility into dependencies throughout technology supply chains. The immediate debate concerns critical infrastructure and suppliers such as Huawei. The bigger corporate lesson is about provenance.
After all, enterprise controls tend to follow contractual relationships. A company buys from Supplier A, so procurement evaluates Supplier A. Know your business (KYB) verifies Supplier A. Accounts payable sends money to Supplier A. Technology doesn’t follow such neat organizational charts.
A technology stack considered acceptable in one jurisdiction may face greater scrutiny in another. Risk can depend not simply on the supplier but on the underlying technology, where it is deployed, what function it performs and which regulatory regime governs it.
The PYMNTS Intelligence report “Vendors and Vulnerabilities: The Cyberattack Squeeze on Mid-Market Firms” found that hackers increasingly target middle market firms. These companies depend on third-party cloud providers, software-as-a-service platforms and managed service providers, which can leave them exposed.
There is another complication. Some of procurement’s most successful cost-cutting strategies can increase technology risk.
See more: Federal Approval No Longer Guarantees CFOs a Green Light
We’d love to be your preferred source for news.
Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!
The Purchase Order Is Becoming a Compliance Lever
The legal identity of a supplier can remain unchanged while its risk profile changes dramatically. A software company can move workloads to another cloud provider. A hardware manufacturer can replace a critical component. A managed-service provider can introduce a new subcontractor. A supplier can be acquired. Governments can change how they classify particular technologies.
None necessarily requires changing the name on the invoice.
European policymakers have increasingly emphasized supplier diversification and reducing dependency on technology providers considered high risk. That creates a tension companies may increasingly have to quantify. The cheapest vendor could ultimately become the most expensive if replacing it requires ripping technology out of infrastructure after it has been deeply embedded.
A company choosing between two networking, cloud or cybersecurity providers would no longer ask only which delivers the best combination of price and performance. It might also need to know whether alternatives exist, how difficult migration would be and what technologies each provider itself depends upon.
Read more: The $100 Million CFO Rewrites the Rules on Legal Spend
The emerging opportunity today is something closer to continuous KYB for infrastructure: systems capable of mapping not merely Supplier A but the critical companies and technologies sitting behind Supplier A, and detecting when those relationships change.
Instead of discovering problematic technology after deployment, enterprises could increasingly try to stop it at the moment of procurement.
Procurement and payments already contain some of the most powerful policy-enforcement infrastructure inside large companies. Purchase orders determine which suppliers employees can use. Vendor-master controls determine where money can go. AP systems flag unusual account changes. Sanctions controls prevent transactions involving prohibited counterparties.
Companies have spent years getting better at knowing their vendors. The next competitive and regulatory advantage may come from knowing what’s hiding inside, behind, and underneath them.
For all PYMNTS B2B coverage, subscribe to the daily B2B Newsletter.
Add as Preferred Source
