Part 1: Introduction

Strategic suppliers: Understanding and managing the risks of service disruption.

1.1
In this Part, we describe:

What are strategic suppliers?

1.2
Public organisations often rely on third-party suppliers to provide goods and services to enable the delivery of services to New Zealanders. In 2018, we estimated that the public sector spends about $42 billion each year on procuring goods and services.1

1.3
Some suppliers are "strategic suppliers". Strategic suppliers provide goods and services that are critical to delivering public services. These are often highly specialised goods and services that are not easily sourced elsewhere. If a strategic supplier fails to meet its contractual commitments, this could disrupt important public services.

1.4
Some strategic suppliers provide goods and services for only one public organisation or type of organisation. For example, the company that electronically monitors offenders is a strategic supplier for the Department of Corrections. The New Zealand Blood Service is the only supplier of life-saving blood products and is, therefore, a strategic supplier for district health boards.

1.5
In this report, we refer to suppliers that provide essential goods and services to multiple public organisations, and play an important role in supporting the delivery of multiple public services, as "government strategic suppliers". Some examples of government strategic suppliers include:

  • The Government has one main banking provider, which provides banking services to many public organisations.
  • Many public organisations rely on a few large information, communication, and technology (ICT) companies to supply and maintain their information systems. This includes information systems that hold important client details (such as benefit entitlements).
  • There are only a few companies in New Zealand that can deliver major projects, such as big roading projects or large buildings such as prisons and hospitals. Both central and local government organisations rely on these suppliers.

1.6
Over time, public organisations can develop long-standing contractual relationships with their strategic suppliers. This enables strategic suppliers to develop a good understanding of the public organisations they work with and what they need to deliver high-quality public services. It also increases public organisations' reliance on these suppliers. Therefore, public organisations must be alert to, and prepared for, the possibility of a strategic supplier failing to deliver.

Roles of agencies in managing strategic supply risks

1.7
Public organisations are each responsible for assessing and managing supplier-related risks of the public services they deliver. However, no public organisation has responsibility for managing strategic supply risks across the public sector.

1.8
The Ministry of Business, Innovation and Employment (the Ministry) is the government lead for procurement. Its role is to influence and provide guidance to public organisations on procurement good practice. It administers the Government Procurement Rules2 but does not have a mandate to require public organisations to comply with them.

1.9
The Ministry also manages the Government Electronic Tenders Service and 20 all-of-government contracts. All-of-government contracts are central contracts for goods and services commonly bought by public organisations. As the lead agency, the Ministry is responsible for preparing and negotiating each contract, monitoring supplier performance, and contract management.

1.10
Te Kawa Mataaho Public Service Commission's role is to ensure that there are clear expectations for public service chief executives and functional leads. This includes the expectation that the Ministry, as the procurement lead, provides advice on complex, high-risk, and strategically important projects and builds capability across the public sector.

1.11
The Government Chief Digital Officer (the chief executive of the Department of Internal Affairs) is the government lead for ICT procurement. This includes leading and managing the common capability3 ICT contracts across government and providing security certification and continuing assurance of suppliers.

1.12
Other public organisations play a lead agency role for syndicated contracts. Syndicated contracts are another form of collaborative contract where a group of agencies work together to procure goods or services.

1.13
The Department of the Prime Minister and Cabinet has a broader role in identifying nationally significant risks and ensuring that a co-ordinated approach is taken across government towards managing these risks. Strategic supplier or supply risks and issues might be identified as part of this work or arise in a national emergency. Depending on the circumstances, either the relevant lead agency or the Department of the Prime Minister and Cabinet will ensure that a co-ordinated approach is taken. For example, in the early stages of the response to Covid-19, the supply of personal protective equipment presented a potential all-of-government issue. A centralised response led by the Ministry of Health was required to secure access to personal protective equipment and other important medical supplies.

1.14
The Director of Civil Defence Emergency Management also has a statutory obligation to identify nationally significant risks under the Civil Defence Emergency Management Act 2002.

Significant service contracts

1.15
The Government Procurement Rules require some public organisations to report their "significant service contracts" to the Ministry of Business, Innovation and Employment twice a year. Significant service contracts are contracts for goods and/or services "that are critically important to the delivery of business objectives, and pose a significant risk and/or significant impact in the event of supplier or supply failure".4

1.16
The Significant service contracts framework provides guidance for public organisations on how to identify and manage significant service contracts. The framework was introduced in 2016 in response to concerns about how some important government contracts were managed. The purpose of the framework is to "provide confidence to government and the public that important services are being effectively delivered to New Zealand".5

1.17
Government departments, the New Zealand Police, the New Zealand Defence Force, and most Crown entities, including district health boards, must report their significant service contracts to the Ministry. Councils, tertiary education institutions, and other public organisations that are not required to apply the Government Procurement Rules do not report to the Ministry on significant service contracts.

1.18
The suppliers of goods and services for contracts that are reported as significant service contracts are likely to be strategic suppliers for public organisations. Some of these suppliers will be government strategic suppliers. However, not all contracts with strategic suppliers will be significant service contracts.

1.19
The Significant Service Contracts Framework states that the Ministry will maintain a central register of significant service contracts to:

  • enable greater collaboration between public organisations;
  • support public organisations with their significant service contracts; and
  • collate information for Ministers.

1.20
The Ministry occasionally publishes a high-level dashboard on significant service contracts. However, public organisations retain responsibility for managing these contracts, including any associated risks and issues.

1.21
Public expenditure on significant service contracts is substantial. For example, the whole-of-contract value of 608 significant service contracts reported to the Ministry, as at 1 October 2020, was more than $29 billion.6 The dollar value of each contract varies, and low-cost contracts can be as critical to the delivery of public services as high-cost contracts. The Appendix provides further information on significant service contracts based on information reported to the Ministry.

Why we did our audit

1.22
The public sector delivers a wide range of public services that are important to New Zealanders. These include services that keep our towns and cities running (for example, water supply and waste disposal), support people in need (income support and health services), build our skills (education), and help keep us safe (emergency services). New Zealanders rightly expect continuity of these services.

1.23
Given the importance of strategic suppliers to the delivery of public services, we carried out a performance audit to understand how well public organisations, including central agencies, understand the risks of strategic suppliers failing to deliver and whether they have contingency plans in place.

1.24
Some strategic suppliers also provide essential services (for example, power and telecommunications) to other organisations that the public sector relies on or to New Zealanders directly. A significant failure of one of these strategic suppliers (such as financial collapse) could have wide-reaching implications for many New Zealanders.

What we looked at

1.25
We looked at practices across the public sector rather than particular public organisations.

1.26
We looked at the public sector's collective understanding and management of strategic supplier risk, including:

  • whether the Government knows which suppliers are its key strategic suppliers across the public sector;
  • what processes are in place for assessing and mitigating the risk of important public services being disrupted by strategic supplier failure and responding to identified risks and issues; and
  • what reporting is provided to the Government on strategic supply risks to the delivery of public services.

1.27
We also looked at the understanding and management of strategic supplier risk within a selection of public organisations, including:

  • the extent to which public organisations know which of their suppliers are strategic suppliers;
  • what processes public organisations have in place for assessing and mitigating the risk of public services being disrupted by strategic supplier failure and responding to identified risks and issues; and
  • what reporting public organisations provide to their senior leaders and governing bodies.

1.28
Our focus was on the risk of service disruption from a strategic supplier failing to deliver contracted goods and services (for example, because of supply chain issues, a major outage, financial collapse, or the supplier leaving the market). We did not look at other supplier risks such as a privacy breach, cybersecurity risks, or failure to meet health and safety requirements.

How we carried out our work

1.29
We carried out this audit by:

  • reviewing documents that describe how public organisations identify and manage strategic supplier risks;
  • reviewing the broader New Zealand and international literature on public sector understanding and management of strategic supplier risks;
  • interviewing key staff in central and local government organisations and some suppliers; and
  • analysing available data on strategic suppliers to the public sector.

1.30
We spoke with the following public organisations: Ministry of Business, Innovation and Employment, Department of Internal Affairs, the Treasury, Department of the Prime Minister and Cabinet, National Emergency Management Agency, New Zealand Infrastructure Commission – Te Waihanga, NZ Health Partnerships Limited, Pharmaceutical Management Agency (PHARMAC), HealthSource New Zealand Limited, Inland Revenue Department, Department of Corrections, Oranga Tamariki – Ministry for Children, Waka Kotahi NZ Transport Agency, Transpower New Zealand Limited, Ministry of Education, Wellington City Council, and Waikato Local Authority Shared Services Limited.

1.31
We also drew on interviews with councils carried out for our local government risk management work. We spoke with Local Government New Zealand, Taituarā – Local Government Professionals Aotearoa, and the chairperson of a local authority audit and risk committee. We also spoke with a small number of suppliers or supplier organisations: Spark New Zealand Limited, Datacom New Zealand Limited, Fulton Hogan Limited, Downer EDI Limited, and NZRise.

1.32
We analysed the following datasets as possible sources of information on the public sector's strategic suppliers:

  • the significant service contracts reports submitted to the Ministry;
  • data held by the Department of Internal Affairs on use of ICT services for all-of-government common capability contracts; and
  • publicly available data from the Government Electronic Tenders Service on contracts awarded to suppliers.

1.33
The Appendix provides more information on this analysis.

Structure of this report

1.34
In Part 2, we discuss the public sector's collective understanding and management of strategic supplier risk.

1.35
In Part 3, we discuss the understanding and management of strategic supplier risk within public organisations.

1.36
In the Appendix, we describe the available information on strategic suppliers.

1: Office of the Auditor-General (2018), Introducing our work about procurement, Wellington.

2: The Government Procurement Rules are published by the Ministry of Business, Innovation and Employment. Depending on the type of organisation, all public organisations are required, expected, or encouraged to apply the Rules. For more information on the Rules, see procurement.govt.nz.

3: A common capability contract is a type of approved collaborative contract. Common capability contracts establish supply agreements with approved suppliers for selected common goods or services or works purchased across government.

4: See "Significant service contracts framework" in the Procurement section at procurement.govt.nz.

5: Ministry of Business, Innovation and Employment (2016), Significant service contracts framework, Wellington, page 3.

6: Ministry of Business, Innovation and Employment, Significant Service Contracts Dashboard, at procurement.govt.nz.