When a supplier change reopens the risk assessment

Reopen a supplier risk assessment when a change could invalidate the evidence behind the last decision. An annual review date remains useful, but it cannot tell you whether a service acquired new access, moved to another provider or became harder to replace yesterday.

For UK procurement teams, the practical question is which changes need investigation and who can accept the resulting exposure. This article proposes a change-driven assessment method. It complements our supplier cyber assurance before contract renewal guide by concentrating on events between renewals.

Keep the last assessment's scope visible. Route material changes to the service owner and relevant specialist. Update the decision and its evidence rather than simply resetting a questionnaire date.

Record which service, entity, locations, access and dependencies the assessment covered. Identify assumptions that made the arrangement acceptable. A generic “approved supplier” label can conceal an approval limited to a particular activity.

The UK National Cyber Security Centre recommends building assurance into supply-chain management, using performance reporting and acting on findings. Its guidance addresses supply-chain security; the wider operational triggers below are our recommended adaptation for supplier management. 1

A review may be narrow when the changed assumption is narrow. A change affecting the underlying business dependency needs a wider assessment. The review record should explain the chosen scope.

These are proposed internal triggers and contributors, not a statutory UK scoring system. Adapt them to the service and the organisation's decision authority. Financial, privacy or sector-specific issues need competent assessment when relevant.

A changed sales contact is unlikely to warrant the same work as a changed hosting provider. Triage the event against exposure and the previous assessment's assumptions. Record why it does or does not need further investigation.

Ask for evidence that answers the changed question. If access expands, reconcile authorised roles and the service boundary. If a new subcontractor performs critical work, investigate its role and the contractual notification route. A long unchanged questionnaire can add work without resolving the actual uncertainty.

NCSC's continuous-improvement guidance recommends listening and acting on concerns from monitoring, incidents and supplier reporting, while maintaining communication with suppliers. 2

Link the event, evidence reviewed, unresolved questions and decision to the earlier assessment. Name the authorised decision-maker and record the conditions of any continued use. Carry outstanding work into an owned action record.

When a temporary exception is proposed, specify the exposure, interim controls, expiry and evidence needed to remove it. Whether continuation is acceptable depends on the actual risk and decision authority. Procurement pressure does not establish that answer.

Tell affected teams which conditions changed. A technical team cannot enforce an access restriction that exists only in a procurement note. Preserve evidence references and confidentiality limits so another reviewer can understand the decision without receiving unnecessary sensitive material.

Assume a fictional UK distributor uses a supplier to maintain public website content. The business proposes allowing the same supplier to administer customer accounts. The supplier's name and contract value stay the same, but its access and the consequences of error change.

The proposed review begins with that changed role. The owner obtains a defined access model and specialist assessment before treating the earlier approval as applicable. If a restricted pilot is considered, its decision record states the permitted activity and stop conditions. This example represents no real company, assessment outcome or safe operating conclusion.

Fictional assessment amendment for the service expansion above. The service owner's internal request adds customer-account administration to a supplier previously approved only to edit public pages.

This is a narrower and more useful task than asking the supplier to answer every old question again. It also exposes an internal source of change: the customer organisation is requesting wider use, even if the supplier's business has not changed at all.

If the expanded role is later approved, the revised record needs its own scope, authority, evidence and conditions. The existing contract value or unchanged supplier name cannot supply those facts. A certificate may contribute useful assurance within its coverage; the table does not imply that certification validates every proposed activity or replaces technical access review.

No universal rule is proposed here. Investigate the assumptions affected and justify the review depth.

Check its entity, scope and coverage against the changed service. It is one item of evidence.

Compare that statement with what your own service owner knows. An expanded internal use may change your exposure even when the supplier has not changed its offering.

AI assisted research and drafting. Sources checked 7 October 2026. The trigger method is editorial guidance and requires competent adaptation.

Spotted an issue? Contact our editorial desk.