Every supplier has a tier, from T1 Strategic partner to T4 Transactional supplier. The tier sets how closely you manage the supplier: which onboarding checks are created, who signs off go-live, how often risk and contracts are reviewed, and which governance meetings and documents are expected. Tier is separate from inherent and residual risk, which are rated in the Third-party risk section.
A new supplier starts as T3 · Approved supplier. Answer the tier assessment on its record and SupplierVault recommends a tier, explains why and flags when a supplier should move up or down.
The four tiers
| Tier | What it is | How it is managed | Examples |
|---|---|---|---|
| T1 · Strategic partner | Critical to business strategy, competitive advantage or essential operations. Often high-value, hard to replace or deeply integrated. | Executive sponsorship, strategic business reviews, joint roadmaps, continuous risk monitoring and formal improvement plans. | Core cloud provider, strategic technology partner, critical outsourcing provider. |
| T2 · Key supplier | Important to operations, service delivery or departmental objectives, with significant spend, dependency, specialist skills or material service commitments. | Quarterly performance reviews, SLA and KPI tracking, risk assessments, contract milestone monitoring and service improvement plans. | Managed IT services, key software platforms, specialist consultancy. |
| T3 · Approved supplier | Useful, recurring goods or services with manageable risk and limited strategic importance. | Periodic performance checks, annual risk reviews where appropriate, contract and insurance checks, exception-based monitoring. | Standard business software, recruitment agencies, training providers, routine maintenance. |
| T4 · Transactional supplier | Low value, easy to replace, little dependency and usually low inherent risk. | Simplified onboarding, proportionate due diligence and minimal ongoing oversight. | Stationery, one-off low-value purchases, commodity suppliers. |
Open What do the tiers mean? from any supplier's Tier assessment section to see this guide in the app.
What each tier sets up
When a supplier is added, SupplierVault creates an onboarding checklist for its tier. Higher tiers include everything from the tier below.
| Tier | Onboarding checklist |
|---|---|
| T4 | 5 tasks: conflict-of-interest declaration (Procurement, 3 days), entity and sanctions screening (Legal, 5), supplier set-up form (Finance, 7), penny test and call-back (Finance, 9), code of conduct (Procurement, 7). |
| T3 | 10 tasks: conflict of interest, sanctions screening, financial viability, supplier set-up form, penny test and call-back, internal privacy assessment, security questionnaire, code of conduct, agree terms and DPA, create supplier in ERP and raise PO. |
| T2 | The T3 list plus enhanced due diligence, named commercial and technical owners on both sides, negotiated terms and rate card, SLAs and service credits, and an agreed review cadence. |
| T1 | The T2 list plus confirming an executive sponsor, scheduling the first joint QBR, a capacity and roadmap session, an exit and continuity plan and a concentration-risk review. |
The number of days is how long after the task is created it falls due. Each task goes to the first person listed in that team on the Stakeholders page, unless Settings names a reviewer for that team and area. See Tasks and notifications.
How the tier drives the workflow
The tier policy below is shown in the tier guide and on the Onboarding page under The tier model.
| T1 | T2 | T3 | T4 | |
|---|---|---|---|---|
| Due diligence | Enhanced | Standard-plus | Standard | Simplified |
| Go-live approval | Executive or senior leader | Senior manager | Department manager | Supplier manager or Procurement |
| Performance reviews | Monthly operational, quarterly business review | Quarterly | Six-monthly or annual | Exception-based |
| Risk re-assessment | Every 3 months | Every 6 months | Every 12 months | When something changes (data, access, an incident or renewal) |
| Contract reviews | Every month | Every 3 months | Every 6 months | At renewal |
| Executive reporting | Yes | Where relevant | No, normally | No, normally |
Change the review cycles
- Open Onboarding and find How each tier is managed in The tier model panel.
- For each tier, set the risk cycle (every 0 to 36 months) and the contract review cycle (every 0 to 24 months).
- Changes save straight away (you'll see "Saved") and apply to every supplier in that tier.
Set a cycle to 0 to review risk only when something changes, or contracts only at renewal.
The tier assessment
On a supplier's Risk and compliance tab, the Tier assessment section asks five questions. Each answer scores points, and the annual value adds more.
| Question | Answers and points |
|---|---|
| Business criticality: impact if this supplier failed | Low: little impact 0 · Medium: disruption we could work around 2 · High: essential operations stop 4 |
| Information security and data sensitivity | No access to our data 0 · Internal or operational data 1 · Personal data 2 · Sensitive, special category or customer data in bulk 3 |
| Regulatory and compliance exposure | None 0 · Some (contractual or sector rules) 1 · High (regulated activity, e.g. FCA outsourcing, NHS) 3 |
| Availability of alternative suppliers | Many, easy to switch 0 · A few, switching takes months 1 · Very few or none 3 |
| Operational dependency and integration | Stand-alone 0 · Connected to some of our processes or systems 1 · Deeply integrated 2 |
| Annual value used | 250,000 or more 3 · 50,000 or more 2 · 10,000 or more 1 · less 0 (in your reporting currency) |
Where the annual value comes from
Committed spend is normally a yearly figure, so it's used as entered. For example, a 3-year "Committed spend, drawn down by usage" contract with £150,000 committed for the whole term counts as £50,000 a year. If the intake estimate was £40,000 and invoices in the last 12 months total £62,000, the value used is £62,000, which scores 2 points.
Unanswered questions
If you haven't answered a question, SupplierVault fills in a starting answer where it can, shown as "From intake: …":
- Criticality is High if the intake triage said the supplier is critical.
- Data follows "Data access" in Third-party risk: customer data counts as Sensitive if the intake said personal data is involved (otherwise Personal), internal data counts as Internal, none counts as None.
- Dependency is Medium if "Access to our systems or sites" is ticked.
How the recommendation is worked out
Sensitive data and high regulatory exposure each force at least T2, and the reason is shown ("sensitive data needs at least T2 oversight").
Worked example: criticality Medium (2), personal data (2), some regulation (1), a few alternatives (1), connected to some systems (1) and £60,000 a year (2) totals 9. That is below 11 and criticality isn't High, so the recommendation is T2.
What you see
- "Recommended: T2 · Key supplier, because of …" lists the three biggest reasons, such as "£60k a year", "high business criticality", "personal data" or "very few alternatives". It adds "N factors not answered yet" if any are blank.
- If the recommendation is higher than the current tier: "This supplier may need more oversight than its current tier gives it." If lower: "This supplier may be over-managed for its risk and value." Either way a Move to … button appears.
- If it matches: "Matches the current tier."
- The record summary's Where things stand panel shows the recommendation during Intake and Triage, and later only when it differs from the current tier.
- For live suppliers with at least two answers, a recommendation higher than the current tier appears in Needs attention: "should move up to …".
Change a supplier's tier
- Either click Move to … in the Tier assessment, or open the record header and change the Tier dropdown.
- The change is saved and logged in the activity ("Tier changed from … to …").
- If you moved the supplier up, open its Tasks section and click Add N … checklist items. This adds only the tasks the new tier needs that are missing. (The toast may call this "Add the extra checks"; it's the same button.)
Moving a supplier down doesn't remove tasks already created. Close any you no longer need with the outcome "Not needed".
Go-live sign-off by tier
When every go-live gate is green, Sign off and go live appears. The sign-off is always recorded against a named person. By default only T1 is restricted by team: the person signing must be in the Executive team. For T2 to T4 the approval wording is shown as guidance but SupplierVault doesn't check the person's team. With teams set up, a procurement team can name the team that signs off each tier and add a second sign-off: see Teams and Onboarding.
Contract review cycle
For Active and Under review suppliers whose tier has a contract cycle above 0, the Contract section shows "Contract reviews for T2: … · last … · next due …" and a Record contract review button.
An overdue review appears in Needs attention: "contract review overdue".
Which plan includes it
Tiering, the tier assessment and tier checklists are in every plan, including Essentials.
Good to know
- Tier is about how closely you manage the relationship. It doesn't replace inherent and residual risk.
- Only the T1 team restriction is enforced at go-live by default.
- Edited cycle numbers don't update the descriptive text in the policy table.