Part 3: Public organisations' understanding and management of strategic supplier risks

3.1
In this Part, we discuss:

• public organisations' understanding of their strategic suppliers;
• how public organisations assess and manage strategic supply risks; and
• reporting to senior leaders and governing bodies.

3.2
We expected that:

• public organisations would know which of their suppliers are strategic suppliers and have a good understanding of the supply market;
• public organisations would have robust processes in place for assessing and mitigating the risk of public services being disrupted by strategic supplier failure and responding to identified risks and issues; and
• leadership teams and governing bodies would have oversight of strategic supply risks.

Summary of findings

3.3
Public organisations we spoke with generally know which of their suppliers are strategic suppliers. However, they need further guidance on how to identify the suppliers and contracts that are critical to them delivering public services. This would help ensure a consistent approach to how public organisations identify their strategic suppliers and significant service contracts.

3.4
Covid-19 has highlighted the importance of public organisations being able to identify their strategic suppliers and understand their supply chains. As a result, some public organisations have reassessed which suppliers are their strategic suppliers. In our view, all public organisations should regularly assess which suppliers are strategic suppliers, and how they manage their relationships with them, both in normal circumstances and during an emergency. We have also identified several areas public organisations could improve when assessing and managing strategic supply risks.

3.5
Public organisations' reporting to senior leaders and governing bodies on strategic supply risks is currently limited. In our view, senior leaders should require better reporting of strategic supply risks for them and for governing bodies to ensure that they can understand and manage these risks well.

Public organisations generally know which of their suppliers are strategic suppliers

3.6
Most public organisations we spoke with understand which of their suppliers are essential to the delivery of their public services and why.

3.7
How public organisations identify their strategic suppliers varies. Most public organisations we spoke with take a structured approach to classify suppliers by how critical or strategic they are. For example, some public organisations use a four-quadrant model to assess suppliers against the risk or impact of failure and the dollar value of their contracts (see Figure 1).

Figure 1
The model some public organisations use to identify their strategic suppliers

Source: Adapted from Ministry of Business, Innovation and Employment, "Guide to Procurement" at procurement.govt.nz.

3.8
Under this model, strategic suppliers are those that are "high dollar value and high risk/impact" and "low dollar value and high risk/impact" (the top two quadrants in Figure 1). Most public organisations we spoke with recognise that strategic suppliers are not necessarily the suppliers they spend the most money on. They understand that low-cost contracts can also be critical to the delivery of public services.

3.9
The Significant Service Contracts Framework has made public organisations aware of the importance of identifying significant service contracts and strategic suppliers. Some public organisations told us they draw on guidance in the framework to identify their strategic suppliers. Other public organisations have prepared more detailed criteria to inform their analysis of suppliers.

3.10
Some public organisations consider that more detailed guidance is needed to help identify "significant" contracts and promote a consistent approach across the public sector. We agree that further guidance would be useful to ensure that public organisations identify and appropriately manage all contracts that are critical to the delivery of public services.

3.11
Public organisations would also benefit from guidance on identifying strategic suppliers. The Ministry told us that it is creating a toolkit to help public organisations identify their strategic suppliers as part of its supplier relationship management programme.

3.12
Covid-19 has highlighted the importance of public organisations being able to identify their strategic suppliers and understand their supply chains. This knowledge helps public organisations take early action to ensure that important goods and services will continue to be provided in the event of an emergency.

3.13
Covid-19 resulted in some public organisations reassessing which suppliers are strategic suppliers. For example, personal protective equipment and hand sanitiser became critical supply issues for many public organisations in 2020. For public organisations in the social services sector, the early Covid-19 response highlighted that suppliers of contracted services during normal circumstances are not always those with the knowledge and connections required to support communities during an emergency.

3.14
Some public organisations intend to reassess their strategic suppliers, either because of their Covid-19 experience or a shift in organisational strategy. This is good practice. Regular review ensures that public organisations maintain an up-to-date understanding of their strategic suppliers and are well placed to identify and manage any risks of supplier failure. In our view, all public organisations should do this.

Processes are in place for assessing and managing risk

3.15
The public organisations we spoke with have processes in place for assessing and managing the risk of service disruption from strategic supplier failure.

3.16
Public organisations have a strong focus on assessing risk when they source a strategic supplier. For the public organisations we spoke with, this is important for mitigating the risk that a strategic supplier could fail to deliver contracted goods or services and potentially disrupt the delivery of public services. When assessing risk, public organisations told us they consider:

• the supplier's financial position;
• the supplier's skills, experience, and ability to deliver the required goods and services; and
• sometimes, the supplier's business continuity plans.

3.17
Public organisations also consider other important matters at this stage, such as the supplier's health and safety practices and environmental sustainability.

3.18
Some public organisations told us that they have well-established processes for regularly monitoring and assessing risks during the life of the contract. For example:

• actively monitoring supplier performance in delivering contracted goods and services;
• looking for any indications of risk, such as a strategic supplier losing an important contract with another organisation;
• having regular conversations with strategic suppliers to understand any emerging risks and issues; and
• considering the external risks their strategic suppliers face (such as climate change or Covid-19) and what effect these might have on the supplier's ability to continue providing important goods and services.

3.19
Public organisations use a range of strategies and practices to mitigate and manage the risk of service disruption from strategic supplier failure. These include:

• using multiple suppliers or sourcing supplies from multiple locations;
• incorporating "continuity of supply" requirements in contracts, with penalties, and enforcing contract requirements;¹¹
• putting in place governance boards to oversee the delivery of major projects;
• identifying strategic supply risks and mitigations in organisational risk registers;
• carrying out internal audits;
• having contingency plans in the event of supplier failure;
• putting in place risk management plans if there is a high risk of supply or supplier failure; and
• improving the capability of the supply market (for example, through investing in skills development or requiring large suppliers to partner with small or medium-sized businesses to deliver contracts).

3.20
These are all appropriate strategies for mitigating and managing risks.

Supplier relationship management is a key strategy for managing risk

3.21
Supplier relationship management was a topic of our discussions with both public organisations and suppliers. Supplier relationship management is a key strategy used by many of the public organisations we spoke with to identify and manage risk.

3.22
Some public organisations have adopted a formal supplier relationship management approach to guide how they work with their most important suppliers. Although practices vary, they are characterised by open and honest communication, collaboration, joint problem-solving, and regular meetings between senior leaders to discuss performance, risks and issues, and opportunities for creating greater value from the relationship. Some of the public organisations we spoke with see their relationship with strategic suppliers as similar to a partnership.

3.23
Suppliers expressed mixed views about how effectively public organisations manage their relationships with strategic suppliers. All suppliers we spoke with consider that good relationship management is important to achieving good contract outcomes, getting the best value from the relationship, and managing risk. They could give examples of public organisations that do this well.

3.24
However, suppliers also told us that many public organisations take a more transactional approach instead of a strategic relationship-based one. We heard that, in these cases, relationships are often managed at the contract manager level, and the focus is solely on ensuring that contractual obligations are met. This is a lost opportunity to work alongside suppliers to innovate and explore different ways of using their services to better support the delivery of public services and achieve the Government's broader procurement outcomes.

3.25
Some public organisations we spoke with expressed concern about public organisations under-investing in supplier relationship management. They suggested, for example, that many public organisations fail to recognise that effective supplier relationship management requires more than a "coffee and a chat".

3.26
Building strong collaborative relationships is particularly important for suppliers providing critical goods and services. This enables public organisations to better understand and mitigate risks, identify and manage any issues early, and work with strategic suppliers to secure the long-term supply of essential goods and services. In our view, public organisations should ensure that their investment in supplier relationship management reflects the importance of the services being provided.

3.27
The Ministry has set up a group of public organisations (known as a "community of practice") to create tools, provide guidance, and promote consistent supplier relationship management practices across the public sector. This is a positive development. As noted in paragraph 3.14, we recommend that public organisations regularly assess how they manage their relationships with their strategic suppliers. The Ministry told us that the toolkit it is preparing will provide guidance for public organisations on how to do this.

There are some areas for improvement

3.28
Public organisations have different levels of experience and capability in assessing and managing the risks associated with their strategic suppliers. We identified the following areas for improvement:

• ongoing risk assessment;
• attention to supply chain risks;
• appropriate allocation of risks in contracts; and
• building procurement capability.

3.29
Although some public organisations regularly monitor and assess risks, others told us they or other public organisations do not put enough emphasis on assessing and managing risk during the life of the contract. This means that, if a strategic supplier fails, public organisations are unprepared and this could potentially disrupt the delivery of important public services. This is consistent with our previous finding that public organisations need to improve their contract management.¹² Ongoing risk assessment appears to be stronger in public organisations where there is centralised oversight of contracts with strategic suppliers.

3.30
Our work on the Ministry of Health's management of personal protective equipment highlighted the importance of understanding the risks and vulnerabilities of supply chains. For this audit, we found that some public organisations consider supply chain risks and, for example, seek information about a supplier's relationships with its suppliers or, since Covid-19, seek information about transport routes for essential supplies (for example, medicine).

3.31
However, some public organisations do not fully understand supply chains for the essential goods and services they rely on or their vulnerabilities during an emergency. This means that these organisations do not understand the risks and, therefore, are not adequately prepared for supply failure, making them more vulnerable to service disruption. This is an area where we expect to see improvement.

3.32
We heard concerns from public servants and suppliers that public organisations are not always aware that their procurement approach can create risks. The main concern was that public organisations try to "contract their way out of risks" by placing unreasonable requirements on suppliers. We also heard concerns about unrealistic and inflexible time frames placed on suppliers. Such behaviour can increase costs and put the supplier in the position where failure is more likely, or deter suppliers with the required skills and capability from accepting the contract. This might increase the likelihood of a less suitable supplier being awarded the contract and then failing to deliver contracted goods or services.

3.33
Concerns about unfair contracts and expecting suppliers to take on risks they cannot manage are not new. These concerns have been raised in the infrastructure sector. We are aware that work is under way through the Construction Sector Accord to ensure that government contracts are fair and transparent and that risk is allocated appropriately. It is a well-established principle that risks should be allocated to the party best able to manage them.

3.34
We saw a continuing need to improve procurement capability in public organisations. Public organisations need the organisational capability, skills, and experience to work effectively with strategic suppliers and be alert to, and prepared for, any supply risks. Where organisational capability is lacking, there is a heightened risk that public organisations are unprepared for possible supplier failure and, as a result, disruption to important public services. As we noted in our December 2019 report Using "functional leadership" to improve government procurement, public organisations and the Ministry have a role in developing procurement capability.

3.35
The Ministry is preparing a toolkit that provides the opportunity to support improvement in procurement capability. We understand that the toolkit will provide guidance for public organisations on how they work with their suppliers and identify and manage risks.

Reporting on strategic supply risks is limited

3.36
Reporting to senior leaders and governing bodies on strategic supply risks is currently limited and should be strengthened.

3.37
Public organisations that are subject to the Government Procurement Rules must report their significant service contracts to the Ministry twice a year. One purpose of reporting is to increase the visibility of significant service contracts within public organisations. The intended outcome is that senior leaders know about the opportunities, risks, and issues with these contracts and are engaged in how these are being managed.

3.38
Public organisations we spoke with had mixed views of the value of the reporting requirement (which we discuss in paragraph 2.11). However, they agreed, in principle, with the underlying intent of creating greater awareness and oversight of these contracts among senior leaders.

3.39
Local government organisations are not required to report significant service contracts to the Ministry so there is no equivalent way of increasing visibility of strategic suppliers or strategic supply risks in local government.

3.40
Other public sector reporting on strategic supply risks is limited. Some public organisations we spoke with have identified strategic supplier or supply risks as strategic risks. They report these risks to their leadership teams as part of their risk-reporting processes. A few public organisations have prepared specific reports on supply risks in response to Covid-19. Only one public organisation we spoke with is considering specific and ongoing reporting to its leadership team on strategic supply risks and issues.

3.41
There is little planned reporting of strategic supply risks to Ministers or governing bodies (boards and councils). We were told that reporting typically occurs after an issue has arisen or as part of reporting on important projects.

3.42
We expect public organisations, as a general principle, to be transparent about their strategic risks, including strategic supply risks, and provide for appropriate oversight of risk management. Reporting to senior leaders and governing bodies is an important mechanism for providing this transparency and oversight. Senior leaders need to be requesting this information from their public organisations. Without this information, there is a risk that senior leaders and governing bodies will be unaware of strategic supply risks and public organisations will not give enough attention to ensuring that risks are well-managed. This creates the risk of disruption to important public services in the event of supplier failure.

11: However, our work on personal protective equipment found that such provisions could not effectively be enforced in circumstances of increased global demand. See our report Office of the Auditor-General (2020), Ministry of Health: Management of personal protective equipment in response to Covid-19, Wellington.

12: Office of the Auditor-General (2018), Introducing our work about procurement, Wellington.