Supplier tiering
Tiering lets you spend your time on the suppliers that matter most, and keep the rest simple.
Treating every supplier the same means either too much effort on small suppliers or too little on the important ones. Tiering fixes that. You put each supplier in a tier, and the tier decides how much due diligence it gets, who approves it and how often it is reviewed.
The four tiers
T1 Strategic partner
Suppliers critical to business strategy, competitive advantage or essential operations. Often high-value, difficult to replace, or deeply integrated into the organisation. They need executive sponsorship, regular business reviews, shared roadmaps and a tested exit plan.
T2 Key supplier
Important to operations, service delivery or departmental objectives, but not necessarily strategic. They may have significant spend, operational dependency, specialist skills or important service commitments.
T3 Approved supplier
Suppliers providing useful, recurring goods or services with manageable risk and limited strategic importance.
T4 Transactional supplier
Low value, readily replaceable suppliers with limited business dependency and typically low inherent risk.
What the tier changes
These are SupplierVault's suggested defaults. Every organisation can change them.
| T1 | T2 | T3 | T4 | |
|---|---|---|---|---|
| Due diligence | Enhanced | Standard-plus | Standard | Simplified |
| Approval | Executive or senior leader | Senior manager | Department manager | Supplier manager or Procurement |
| Risk reassessment | Every 3 months | Every 6 months | Annual | When something changes |
| Contract review | Monthly | Quarterly | Six-monthly | At renewal |
Every supplier, including T4, needs a named person to sign it off before it goes live. Simplified checks are not the same as no checks.
How to decide the tier
Ask a few questions about each supplier:
- How much do we spend, or commit to spend, each year?
- How hard and how slow would it be to replace them?
- Do they handle sensitive or personal data?
- Do they have access to our systems or premises?
- Would a failure stop an essential service?
- Are they subject to regulatory rules, such as outsourcing rules?
Value is not the only factor
A supplier you pay £5,000 a year can still be high risk. A small payroll bureau holding every employee's bank details, or an IT contractor with administrator access, deserves more oversight than its spend suggests. Treat sensitive data access or high regulatory exposure as a reason to move a supplier up at least to T2.
Keep tier and risk separate
The tier describes how important the supplier is to you. Risk describes what could go wrong. Record inherent risk (before controls) and residual risk (after controls) as separate ratings. A T3 supplier can be high risk, and a T1 supplier can be well controlled.
Common mistakes
- Putting too many suppliers in T1, so the extra oversight becomes impossible to keep up.
- Tiering once at onboarding and never again.
- Using spend alone and missing small suppliers with big access.
Review tiers regularly
Suppliers change. Spend grows, a supplier starts handling new data, or a contract becomes business-critical. Revisit the tier at each review and whenever something significant changes.
Doing this in SupplierVault
SupplierVault sets the workflow from the tier, suggests a higher tier when a supplier's answers or spend call for one, and lets you change the defaults for your organisation. Read more about supplier risk and tiering, or try it in the live demo.