Our Crowe UK client’s supplier risk framework had developed organically and was no longer aligned with SS2/21 expectations.
Without a central procurement function, processes were inconsistently applied, and gaps had emerged in governance, due diligence and oversight of material outsourcing arrangements.
The engagement began with a full SS2/21 gap analysis and effectiveness review to assess our client’s supplier and outsourcing risk management framework. Crowe UK worked closely with operations, risk, IT and compliance teams to understand current practices and identify areas of non-compliance.
This was followed by the development of practical, proportionate recommendations to address gaps in governance, due diligence and oversight. We supported the design of a risk-based triage process, including a tailored risk assessment template and revised due diligence questionnaires.
To strengthen resilience, we helped develop supplier business continuity plans and exit strategies for material outsourcing. We also supported backfilling of risk assessments and due diligence and integrated a supplier risk module into our client’s GRC system to embed the new approach.
Our client now has a robust, proportionate framework for managing supplier and outsourcing risk that meets the expectations of SS2/21. Governance, risk and compliance functions have taken joint ownership of the approach, ensuring consistent application and accountability across the business.
The introduction of a risk-based triage process and updated due diligence tools has improved the quality and efficiency of supplier assessments. Business continuity and exit strategies are now in place for material outsourcing arrangements, strengthening operational resilience.
With the supplier risk module embedded into the governance system, our client is well positioned to support future growth and demonstrate regulatory compliance with confidence.