Tier your suppliers by consequence
Applying identical due diligence to every supplier wastes effort and still misses critical exposure. Tier suppliers by the consequence of their failure — safety, security classification, schedule criticality — and set assurance depth accordingly.
- Tier 1: on-site audit, annual, full evidence review
- Tier 2: desktop assessment, annual, sampled evidence
- Tier 3: self-assessment questionnaire, on renewal
Contract for the evidence you need
Assurance rights must exist in the contract before they are needed. Include audit access, subcontractor flow-down obligations, incident notification timeframes and record retention periods in every tier 1 and tier 2 agreement.