Part 2: Public sector understanding and management of strategic supplier risks

2.1
In this Part, we discuss:

• visibility of strategic suppliers across the public sector;
• roles, responsibilities, and processes for assessing and managing strategic supply risks; and
• system-level reporting to Ministers.

2.2
We expected that:

• the Government would know which suppliers are strategic suppliers in the public sector, both in normal circumstances and in emergencies;
• the public sector would have processes in place for assessing and mitigating the risk of important public services being disrupted by strategic supplier failure and responding to identified risks and issues; and
• public organisations would provide reporting to Ministers on strategic supply risks to the delivery of public services.

Summary of findings

2.3
Many public organisations report their significant service contracts to the Ministry. An important purpose of reporting significant service contracts is to provide visibility of critical contracts across government. However, there is no system-wide visibility of government strategic suppliers.

2.4
Lack of system-wide visibility of government strategic suppliers is a significant concern. It means that the Government does not fully understand (and therefore cannot effectively manage) the risk of disruption to important public services if a strategic supplier fails to deliver. The Ministry has work under way that is likely to improve understanding of government strategic suppliers. In our view, the Ministry also needs to improve the reporting tool for significant service contracts and regularly analyse, share, and report on this information.

2.5
We found little evidence of processes for assessing and managing risks associated with government strategic suppliers. Roles and responsibilities for assessing and managing risks are unclear and there is no reporting to Ministers. Local government organisations are not collectively considering strategic supply issues, and lack processes for assessing and managing strategic supply risks. A co-ordinated approach to assessing and managing risks is required for strategic suppliers that provide services to a range of public organisations.

2.6
We also identified a need to better communicate priorities to government strategic suppliers if there are competing demands from public organisations for essential goods and services after an emergency. We expect the public sector to proactively consider priorities as part of emergency response planning and to tell suppliers about these priorities as soon as possible after an emergency.

There is no system-wide visibility of government strategic suppliers

2.7
Reporting significant service contracts to the Ministry is intended to provide visibility of critical contracts across government. Therefore, information should be readily available about government strategic suppliers and the extent of their business with the Government.

2.8
Many public organisations do report their significant service contracts to the Ministry, but there is no system-wide visibility of government strategic suppliers. Although public organisations we spoke with had some idea about which suppliers are (or are likely to be) strategic suppliers, there is no common and stated understanding across the public sector.

2.9
There are several reasons for this:

• Reporting on significant service contracts does not record the full extent to which public organisations rely on strategic suppliers:
  • Many public organisations, including local government organisations, are not required to report. Yet these public organisations deliver important public services to New Zealanders and are likely to rely on many of the same strategic suppliers.
  • Information is available only on a strategic supplier's significant service contracts and not on the many other contracts the supplier could have with public organisations.
• There are issues with the quality of information that is reported:
  • Public organisations make their own assessments about which contracts are significant and therefore reported. We are aware there is at least one supplier that the Ministry considers a government strategic supplier that few public organisations have identified in their significant service contracts reporting.
  • In any reporting period, some public organisations fail to submit a report. Thirteen public organisations have never reported their significant service contracts to the Ministry despite being required to by the Government Procurement Rules.
  • There are inconsistencies in how information is recorded. For example, public organisations often identify suppliers differently or record contract values as text instead of figures. This limits the analysis that can be done.
  • Public organisations do not always provide requested information. For example, the supplier's New Zealand Business Number and the United Nations Standard Products and Services Code are often missing. This means that data cannot be easily linked to other datasets to provide a fuller picture of a supplier's business with the Government.
  • Explanatory information, including commentary on risks and issues, is often limited. This reduces the value that can be obtained from the reporting.
• The Ministry does not carry out regular analysis of the reported information or share it with other public organisations. It occasionally publishes a dashboard on its website, but the information is too high level to provide a useful picture of government strategic suppliers and associated risks.

2.10
Quality issues with the significant service contracts data are partly attributable to the reporting tool. The tool is a modifiable spreadsheet template that public organisations fill out and email to the Ministry. It comes with a mix of open-text and fixed-response fields. Although guidance on how to use the template is available, there is considerable inconsistency in how public organisations complete the reports. The Appendix provides further information on our assessment of the significant service contracts data.

2.11
A perceived lack of value from some public organisations in reporting significant service contracts might also contribute to poor data quality. Public organisations we spoke with for this audit and our 2019 audit of the Ministry's procurement leadership role⁷ told us that they do not know what happens to the information they provide. They get no comments or questions from the Ministry about risks or issues identified in their reports, nor any information about risks or issues that other public organisations experience with the same strategic supplier. Those we spoke with suggested that many public organisations treat reporting significant service contracts as a compliance exercise that has limited value to them.

2.12
We looked at what other information is available on strategic suppliers, as well as significant service contracts reporting. We found few alternative sources of information on strategic suppliers. Information that is available covers only a specific service or sector. For example, we found several emergency management reports that show a good understanding of government strategic suppliers for a particular good or service (for example, fuel supply). However, the total picture is fragmented.

Lack of visibility means the Government cannot fully understand and manage risk

2.13
Lack of system-wide visibility of government strategic suppliers is a significant gap. It means that the Government does not know how much it relies on any one supplier. As a result, the Government cannot fully understand (and therefore manage) the risk of disruption to important public services if a strategic supplier fails to deliver.

2.14
This point was recently emphasised to the Ministry in a review commissioned after a strategic supplier experienced a service outage. That review recommended that the Ministry and the Government Chief Digital Officer identify the 10 most critical suppliers to government and ensure that the risk exposure is understood and managed.

2.15
The Ministry recognises the need for better understanding government strategic suppliers. It has initiated a programme of work on supplier relationship management. This includes a focus on government strategic suppliers. The Ministry has analysed recent information on significant service contracts and is seeking to supplement this with information from other sources to identify and assess the Government's business with 50 to 100 suppliers.⁸ It will then test a whole-of-government approach to managing the relationship with two strategic suppliers. The Ministry intends to review the success of this approach and create a business case for expanding the supplier relationship management programme. The Ministry told us it is also working to improve its procurement data and ability to provide insights through implementing its Digital e-Procurement Strategy during the next five years.

2.16
In our view, these initiatives are a step in the right direction. However, the Ministry also needs to improve the significant service contracts reporting process to improve the information available on government strategic suppliers. This should include, for example, stronger controls in the reporting tool to improve data quality, regular analysis of reported information, feedback to agencies supplying the data, and expanding the dataset to include more information on strategic suppliers' business with the Government. If this is done well, it would help improve visibility of government strategic suppliers and associated risks. Without it, the Government will continue to be uninformed about the risks it faces.

2.17
Improving the reporting process and making use of, and sharing, the information will also demonstrate its value to public organisations. This, in turn, is likely to result in improved data quality and build system-wide confidence in the significant service contracts information.

2.18
We also see value in a shared understanding of the most critical public services and supporting infrastructure. Knowing which public services are most important would help inform an assessment of government strategic suppliers. The Treasury has created a tool to assess the relative criticality of public assets. The tool aligns with the Government's well-being approach and could be adapted to inform an assessment of critical public services and strategic suppliers.

2.19
Strategic suppliers failing is only one aspect of what might cause service disruption. Integrating this work in a broader assessment of service failure risks would provide a more robust risk management dataset and could underpin a more structured approach to addressing the risks of critical service failures. This is a subject of interest to us.

Roles, responsibilities, and processes for assessing and managing strategic supply risks are unclear

2.20
Being able to identify government strategic suppliers is essential to understanding and managing risks. Effective risk management requires that:

• the public sector has processes in place for assessing and managing risks;
• roles and responsibilities for assessing and managing risks are clear and well understood; and
• risk management activity is co-ordinated between public organisations.

2.21
Co-ordinated approaches are particularly important in times of heightened demand to ensure that public organisations are not competing for critical supplies. For example, our work looking at how the Ministry of Health managed personal protective equipment identified a need for co-ordinated procurement of supplies in response to Covid-19.⁹

Processes for assessing and managing risks are not well-established

2.22
We saw little evidence of established processes for assessing and managing risks associated with government strategic suppliers. This is not surprising, given that the Government does not have visibility of its strategic suppliers. The central government organisations we spoke with all saw a need for cross-government processes to better understand and manage strategic supplier and supply risks. We agree.

2.23
We identified several practices and initiatives that could help the public sector to manage risk. For example:

• Public organisations sometimes share information on their strategic suppliers and the risks and issues they experience. Information sharing occurs through informal phone calls or in meetings of cross-sector groups (such as the Social Services Procurement Committee, the Joint Procurement Leads Group for the health sector, or the Crown Collaboration Construction Forum).
• The Ministry's planned work to test a whole-of-government approach to managing relationships with strategic suppliers has the potential to improve understanding and management of risk. The Ministry is also establishing an assurance function for procurement that could help to identify and address common issues with strategic suppliers.
• The public sector is aware of the risk of strategic supplier failure in the construction sector, and the effect on important public sector infrastructure projects should that occur. The Construction Sector Accord is a joint commitment between the Government and the industry and includes a range of initiatives to improve the capability and resilience of the construction sector.
• The Ministry of Education has led work on assessing the financial position of infrastructure suppliers on behalf of several public organisations. The initiative could be extended to include more public organisations, a wider range of information, and/or other supply sectors. We were told that the assessment tool is also informing industry-led work to improve the financial health and sustainability of suppliers.
• The Infrastructure Commission is developing a pipeline of planned infrastructure to provide greater visibility of upcoming projects across the public sector. The purpose is to enable better co-ordination of projects and better use of limited resources.

2.24
These are promising initiatives. However, they each have limitations. For example, occasional information sharing cannot ensure a thorough understanding of risk. It also does not necessarily lead to co-ordinated risk management. A whole-of-government approach to managing strategic supplier relationships has yet to be tested, and so no decisions have been made on any wider roll-out of the approach. Construction sector initiatives focus solely on the construction sector and not the other sectors that public organisations rely on (such as ICT, facilities management, and health care).

2.25
Further, existing practices and initiatives are not enough to ensure a well-co-ordinated and system-wide approach to assessing and managing the Government's strategic supply risks. In our view, there is a significant gap in processes for assessing and managing risks to ensure that New Zealanders continue to receive critical public services if a strategic supplier fails to deliver.

There is a need to clarify roles and responsibilities

2.26
Roles and responsibilities for assessing and managing risks about government strategic suppliers are unclear. For example, although the Ministry provides guidance to public organisations and collates information on significant service contracts, it does not have a mandate to co-ordinate risk assessment and management for government strategic suppliers. Other public organisations do not have this mandate either. The Ministry is leading work to test a whole-of-government approach to managing relationships with government strategic suppliers. However, the respective roles of the Ministry and other public organisations have yet to be clarified.

2.27
The lead agencies for all-of-government, common capability, and syndicated contracts are responsible for providing some cross-government risk assessment of suppliers (some of which might be strategic suppliers). However, the lead agency role covers only the collaborative contract and not the supplier's whole relationship with the public sector.

2.28
It is not clear how information on strategic supply risks feeds into processes led by the Department of the Prime Minister and Cabinet for managing nationally significant risks. It is also not clear who has responsibility for ensuring that this happens. In our view, this needs to be clarified.

Consideration needs to be given to strategic supply risks in local government

2.29
We did not see any evidence of local government considering strategic supply issues. We also did not see any processes for assessing or managing shared strategic supply risks across local government.

2.30
Councils are self-governing entities and make their own decisions on how they assess and manage risks. However, there are formal and informal networks for sharing information between councils, and some regions have shared-services arrangements for procuring goods and services (for example, Waikato and Bay of Plenty). These networks and arrangements provide opportunities for councils to discuss strategic suppliers and strategic supply risks.

2.31
We strongly encourage the local government sector to use forums such as the Local Government Strategic Procurement Group to:

• identify strategic supply risks to critical public services delivered by local government; and
• work with central government to establish a better national understanding of risks and ensure that risks are well-managed and co-ordinated.

The public sector should better communicate service priorities to strategic suppliers after an emergency

2.32
The public sector has well-established processes for responding to issues that arise after an emergency. For example, emergency management legislation states which services must continue operating during an emergency. The Coordinated Incident Management System, which is used to organise emergency responses, establishes clear roles and responsibilities. The Coordinated Incident Management System documents also acknowledge the need to prioritise access to goods and services in an emergency.

2.33
We found many examples of public organisations working together, and with business and community organisations, to address strategic supply or supplier issues in response to Covid-19. These examples include:

• keeping major air freight routes open;
• prioritising ICT support to essential agencies and services;
• ensuring that suppliers were paid on time and not unfairly penalised for contracts not delivered during the Covid-19 lockdown; and
• leveraging relationships with other countries to secure access to critical medical supplies.

2.34
Some of those we spoke with told us the public sector is good at working collaboratively in an emergency. A few suppliers suggested that collaborative approaches developed in emergency situations could be used to address critical supply issues at other times as well. For example, the Stronger Christchurch Infrastructure Rebuild Team and North Canterbury Transport Infrastructure Recovery alliances were set up after the Canterbury and Kaikōura earthquakes to address the large-scale infrastructure work required.

2.35
We identified a need for more co-ordinated and timely communication from public organisations to strategic suppliers after an emergency. Suppliers told us that some public organisations make contact promptly after an emergency. However, most suppliers we spoke with said that the public sector does not provide advice on which public services should be prioritised. One supplier told us they got advice on priorities three weeks after the Covid-19 lockdown. This advice was too late to be useful because the supplier had already sold essential supplies (like laptops) to enable public organisations and students to work remotely.

2.36
Failure to communicate clearly to suppliers about which public services should be prioritised in an emergency creates the risk of resources being allocated to the wrong priorities. We expect the public sector to proactively consider priorities for service delivery as part of emergency response planning and to let suppliers know these priorities as soon as possible after an emergency, rather than leave those decisions for suppliers.

There is no system-level reporting to Ministers

2.37
There is no system-level reporting to Ministers on risks associated with government strategic suppliers. The Ministry reported to Ministers on significant service contracts after the Significant Service Contract Framework was introduced. We also understand that Ministers with ICT-related portfolios met regularly to discuss key ICT projects across government, including risks and issues. However, we were told that Ministry reporting and regular ministerial discussion of ICT projects have not occurred since 2017.

2.38
The purpose of the Significant Service Contract Framework is to "provide confidence to government and the public that important services are being effectively delivered to New Zealand".¹⁰ This is an important purpose. However, the public sector cannot provide this confidence until work is carried out to:

• improve the quality of information on strategic suppliers and the significant service contracts they hold with the Government; and
• ensure that this information is regularly collated, analysed, and reported to the Government.

2.39
Good information on strategic suppliers is an important first step for the public sector to effectively manage the risks of service disruption from strategic supplier failure.

7: Office of the Auditor-General (2019), Using "functional leadership" to improve government procurement, Wellington.

8: At the time of our audit, the Ministry was still deciding how many suppliers to include in the assessment.

9: Office of the Auditor-General (2020), Ministry of Health: Management of personal protective equipment in response to Covid-19, Wellington.

10: Ministry of Business, Innovation and Employment (2016), Significant service contracts framework, Wellington, page 3.