Oliver Norman, Chief Revenue Officer of Nomia
While financial institutions have invested heavily in governance around their most critical suppliers, thousands of smaller purchases can sit outside the same level of scrutiny. This can create an uneven understanding of supplier risk, with detailed oversight of major providers and much less confidence about the businesses used for everyday services.
This deserves closer attention because the value of a purchase tells an institution little about the exposure it creates. A relatively inexpensive software tool may handle sensitive information, while a specialist consultant could have access to internal systems. When spend determines which suppliers receive attention, relationships with meaningful risks can remain largely unexamined.
When supplier relationships outgrow their agreements
Many of these relationships may have begun years ago, when a team needed a service quickly, and the supplier’s role was limited. Over time, the service may have expanded into other departments or started handling information that was never covered by the original agreement.
The institution’s own requirements may also have changed. Procurement policies, security expectations, and data protection controls can all move on while an older contract continues to renew. Familiarity with a supplier can make that arrangement feel settled, even when nobody has checked whether the terms still reflect how the business uses it.
An agreement does not become unsuitable simply because it is old, but its continued use needs a sound basis. A supplier that passed checks several years ago may now present a different risk, particularly if its access, responsibilities or subcontracting arrangements have changed.
For procurement and audit teams, this raises a difficult issue. The institution may have clear policies on paper while lacking evidence that those policies have been applied consistently across its wider supplier base. That gap can become apparent during an audit or incident, when teams need to establish what was agreed and who was responsible for reviewing it.
The limits of supplier visibility
Bringing supplier information together helps expose these gaps, particularly where records are spread across finance systems, spreadsheets and email chains. Knowing that a supplier exists does not establish whether its agreement is current or its risk assessment remains appropriate.
Audit readiness depends on being able to explain why a relationship is acceptable today. Teams need evidence that the assessment reflects the service being delivered, with outstanding issues assigned to someone who can resolve them. A completed onboarding record offers limited reassurance if the relationship has changed substantially since approval.
This does not mean every small purchase needs the scrutiny applied to a major outsourcing arrangement. Reviews should be proportionate to the supplier’s role, considering its access to information and the consequences if its service fails. Commercial value remains relevant to procurement, but on its own it offers an incomplete basis for deciding how much risk oversight a relationship needs.
The challenge is applying that judgment across thousands of agreements without allowing the volume of work to become a reason for leaving them untouched. AI can help teams extract contract terms and identify potential gaps against defined requirements, reducing some of the repetitive work involved in an initial review. Interpreting those findings still require procurement expertise, with legal and risk teams involved where necessary to interpret the terms in context.
Reviewers need to be able to verify the underlying evidence and decide whether clarification, negotiation, or a fresh assessment is required. Finding a gap has value only when someone takes responsibility for closing it, which makes ownership as important as the ability to review documents quickly.
Approval needs to remain relevant
A trusted supplier base requires ongoing attention as services and regulatory expectations change. Contract renewals should provide an opportunity to check whether the agreement still reflects the relationship, rather than allowing earlier decisions to carry forward without review.
Financial institutions need confidence that the controls they have designed are being applied to the suppliers they use. Smaller purchases deserve a place in that assessment because a low invoice value cannot establish whether a supplier’s access, obligations, or contract terms remain appropriate.
