Key Takeaways
- Tier 1 is only part of the picture. Supplier risk management has to account for the dependencies beneath your suppliers, such as cloud providers, data centres and shared platforms, because that is often where disruption starts.
- Start from impact, not supplier volume. Map what your most important services depend on, and go deeper only where you find concentration, a single point of failure or a shared dependency.
- Connect what each function already knows. Procurement, IT, TPRM, Operational Resilience, Risk and the business each hold part of the picture. Bringing those views together does more than adding another layer of supplier questionnaires.
Most organisations now know which business services matter most. The harder question for supplier risk management is whether those services can keep running when something underneath them fails.
Answering that means looking at what each service depends on: internal technology, people, data and processes, the external suppliers that support it and, where the impact justifies it, the dependencies beneath those suppliers.
Procurement, IT, TPRM, Operational Resilience, Risk and the business each see part of that chain. Usually, no single one of them sees all of it.
Why Tier 1 is only the start
Take a major technology provider such as AWS, Microsoft or Oracle. In July 2026, HM Treasury designated AWS, Google Cloud, Microsoft and Oracle as the first UK Critical Third Parties, because a disruption to their services could affect many firms at once [1]. That matters, but naming the provider doesn’t take you to the end of the chain. Those providers rely on data centres, power, telecoms, hardware, semiconductors, networking equipment and software, and those suppliers have dependencies of their own.
Marsh gives a useful example of how quickly this grows. A global semiconductor manufacturer was trying to understand its supply-chain exposure for its property damage and business interruption insurance renewal, and started with incomplete information on 84 named supplier sites. According to Marsh, supply chain mapping beyond Tier 1 validated information for 94 sites and identified more than 16,000 Tier 2 and Tier 3 suppliers. That work uncovered concentrations and bottlenecks and helped the client secure higher contingent business interruption cover aligned to its actual exposures [3]. It is a vendor case study, so the outcomes are Marsh’s account of the work.
The lesson is not that organisations should run 16,000 supplier assessments. That would be slow and expensive, and it would generate a lot of information without necessarily making the business more resilient.
A practical approach to supplier risk management
A more practical approach starts from impact. Begin with the services where disruption would seriously hurt the organisation. Map the technology, data, infrastructure and suppliers those services need. Then go deeper into subtier suppliers only where there is evidence of concentration, a single point of failure, or a shared dependency that could hit several important services at once.
A useful test for any dependency is this: if it stopped tomorrow, which important service would stop with it, and how quickly? If the answer is “nothing that matters”, it doesn’t need deeper work this cycle.
Concentration and single points of failure
Concentration is often where the surprises are. Marsh reports, based on its Sentrisk platform data, that 65% of the organisations it analysed have at least one single point of failure hidden in their upstream supply chain [4]. Marsh sells that platform, so treat the figure as an indicator rather than a market-wide measurement.
This applies to technology as much as manufacturing. Ten apparently independent software suppliers may all run on the same cloud provider. Several important suppliers may share a data centre, identity platform, network or security tool. Apparently separate AI applications may depend on the same foundation model. Looking only at each Tier 1 supplier on its own can miss all of this.
Regulators are seeing the same pattern. The FCA reports that more than 40% of cyber incidents reported to it in 2025 involved a third party [5] Its freedom of information data for 2021 to 2026 shows that 1,421 of 5,313 reported operational incidents related to third-party failures [6]. The FCA has confirmed new incident and third-party reporting rules, which take effect in March 2027 [5] . Firms remain responsible for managing their own third-party risk, even where the provider itself is overseen by regulators [1][2].
The principle applies well beyond regulated financial services. Someone working in Risk and Resilience put it well to me recently: when something stops the organisation’s ability to trade, everybody suddenly focuses on it. At that point it is no longer a Procurement issue, an IT issue, a TPRM issue or a Risk issue. It is a mission-critical business problem.
Connecting what each function knows
So the task is to connect what each function already knows. Procurement knows suppliers, contracts and commercial leverage. IT knows architecture and technical dependencies. TPRM knows supplier risk and controls. Operational Resilience knows important services, disruption scenarios and impact tolerances. The business knows what actually stops working when something fails, and Risk and Insurance know the financial exposure and whether it has been transferred or retained.
Bringing those views together is worth far more than adding another layer of supplier questionnaires.
The goal is not complete supply chain visibility across every supplier at every tier, which is unrealistic for most organisations. It is to identify the small number of dependencies, concentrations and failure points that could disproportionately stop the business. The next stage of supplier risk management, TPRM and operational resilience should be less about assessing more suppliers and more about understanding how those dependencies connect.
References
- Financial Conduct Authority, “UK financial regulators to begin overseeing Critical Third Parties announced by Treasury”, 10 July 2026. https://www.fca.org.uk/news/statements/uk-financial-regulators-overseeing-critical-third-parties-announced-treasury
- Financial Conduct Authority, “Critical Third Parties: Strengthening UK Financial Services”. https://www.fca.org.uk/firms/critical-third-parties-strengthening-uk-financial-services
- Marsh, “Global semiconductor manufacturer improves their PDBI renewal outcome using Sentrisk”. https://www.marsh.com/en-gb/services/business-interruption-supply-chain/insights/semiconductor-manufacturer-improves-pdbi-renewal-using-sentrisk.html
- Marsh, “Sentrisk: Supply chain risk management platform”. https://www.marsh.com/en-gb/services/business-interruption-supply-chain/expertise/sentrisk.html
- Financial Conduct Authority, “FCA confirms new incident and third party rules to bolster resilience”, 18 March 2026. https://www.fca.org.uk/news/news-stories/fca-confirms-new-incident-and-third-party-rules-bolster-resilience
- Financial Conduct Authority, “Information on third-party and cloud service incidents – July 2026” (FOI2026_01302), 9 July 2026. https://www.fca.org.uk/freedom-information/information-third-party-and-cloud-service-incidents-july-2026
