Auditor-General's overview

E ngā mana, e ngā reo, e ngā karangarangatanga maha o te motu, tēnā koutou.

The public sector provides many public services that are important to New Zealanders. These include services that keep our towns and cities running (water supply and waste disposal), support people in need (income support and health services), build our skills (education), and help keep us safe (emergency services).

New Zealanders expect these public services to be available when they need them, particularly during personal or national emergencies. My staff carried out a performance audit that looked at how well placed the public sector is to meet New Zealanders' expectations when public services rely on third-party suppliers.

Strategic suppliers provide goods and services that are critical to the delivery of public services and are not easily replaced. Some strategic suppliers provide essential goods and services to many public organisations. An example is a large information, communication, and technology company that supports many public organisations' key information systems. We refer to these suppliers as government strategic suppliers. A significant failure of a government strategic supplier could affect many public services and thousands of New Zealanders.

We wanted to know how well the public sector understands and manages the risk of service disruption if a strategic supplier fails to deliver goods and services.

What we found

The public sector does not have a good understanding of which suppliers are government strategic suppliers. Public organisations are required to report their significant service contracts to the Ministry of Business, Innovation and Employment (the Ministry). This reporting is meant to provide visibility of critical contracts across government and within public organisations. It has given public organisations a better understanding of their strategic suppliers. However, there is still no system-wide visibility of government strategic suppliers.

There are several reasons for this. Reporting does not include all public organisations (for example, local government organisations) or all contracts with strategic suppliers. The information that is reported is incomplete and of variable quality. The Ministry does not carry out regular analysis of significant service contracts information, share it with other public organisations, or report strategic supply risks to the Government. This creates the risk that public organisations believe that there is a level of central oversight of significant service contracts when this is not the case.

Lack of system-wide visibility of government strategic suppliers means that the Government does not know how much it relies on any one supplier. It also does not have visibility of the risk of disruption to important public services if a government strategic supplier fails to deliver.

This creates a risk for the Government and New Zealand. Government strategic suppliers do not provide goods and services just to public organisations – they also supply community organisations, businesses, and, in some cases (such as telecommunications and power companies), New Zealanders directly. The potential impact of strategic supplier failure is far reaching.

The Ministry recognises the need to better understand which suppliers are government strategic suppliers. It has started a programme of work on supplier relationship management, which includes a focus on government strategic suppliers. The Ministry intends to identify and assess the Government's business with 50 to 100 strategic suppliers and then test a whole-of-government approach to managing the relationship with two strategic suppliers.

This initiative is a step in the right direction. However, the Ministry also needs to improve the process for reporting significant service contracts to improve the information available about strategic suppliers. If done effectively, this would help improve the visibility of government strategic suppliers and associated risks. Without this information on strategic suppliers, the Government will continue to be uninformed about some of the risks it faces.

There also needs to be greater clarity about roles, responsibilities, and processes for managing key strategic supplier risks and how these interact with processes for managing other nationally significant risks. Effective risk management requires a co-ordinated approach. This is so public organisations know what their role is, what others are doing, and how they need to work together to manage the risk of disruption to public services from strategic supplier failure.

We did not see any consolidated information on strategic suppliers in local government or processes for assessing or managing strategic supply risks. However, local government organisations are likely to rely on many of the same strategic suppliers as central government. I encourage local government and central government to work together to establish a better national understanding of risks and ensure that these are well-managed and co-ordinated.

We identified a need for better communication with government strategic suppliers about which public services should be prioritised after an emergency. We expect the public sector to proactively consider priorities as part of emergency response planning and to tell suppliers about them as soon as possible after an emergency, rather than leave those decisions to suppliers.

Most public organisations know which of their suppliers are strategic suppliers. However, in our view, some public organisations could improve the way they identify and manage strategic supply risks. Improvements include public organisations regularly assessing which suppliers are strategic suppliers and investing in effective relationship management. Senior leaders should require better reporting of strategic supply risks to them and to governing bodies to ensure that risks are well understood and managed.

Covid-19 has highlighted New Zealand's vulnerability to global supply chains, as well as the need for the public sector to strengthen the resilience of service delivery. Understanding and managing strategic supply risks is an important part of that. Strategic supplier management is only one aspect of ensuring that services to New Zealanders are not interrupted. I also expect public organisations to consider more broadly their preparedness for shocks to ensure that important public services continue to be delivered in an emergency.

The current state of strategic supplier management across the public sector is concerning. Important public services will remain vulnerable to unexpected failure unless the public sector makes improvements to the way it manages strategic suppliers.

I thank the many people who contributed to this audit and took the time to talk with my staff, including suppliers and public organisations in both local and central government.

Nāku noa, nā

John Ryan
Controller and Auditor-General

2 June 2021