Legal
Passing the requirement down the chain
Your client makes demands of you and you depend on four suppliers who have never heard of them. You are what holds the chain up.
You signed with a demanding client, and inside that signature are commitments that **do not depend on you but on the people you buy from**: whoever hosts the data, whoever performs part of the service, whoever sends the technicians. Yours is the position holding the chain up, and it is also the only one that can be chased from both sides at once.
The sum that does not add up on its own
| What is required of you | Who it depends on | Who answers |
|---|---|---|
| How you handle the information | You | You |
| Where it is hosted | Your supplier | You |
| Who may access it | Both | You |
| **What your supplier's supplier does** | **Nobody you know** | **You** |
Important
**The rule that avoids 90% of this position's problems is requiring downwards at least what is required of you — and doing it when you contract, not when you are asked.** What is not in your contract with the supplier you will not obtain later: at that point you are a client asking a favour, and the favour has a price or a polite refusal.
What to hold for each supplier touching the client's work
- 1
What you required of them, in writing
And checking it covers what was required of you.
- 2
What they have provided and when
With dates, because what expires here expires upwards.
- 3
Who they subcontract to
Asking at contracting is normal; asking afterwards is an incident.
- 4
And what happens if something changes
A supplier that moves premises or owners affects you before they tell you.
Watch out
The moment this position hurts is **a client audit that goes one level deeper**. They no longer ask what you do: they ask about your suppliers, by name. If that question is met with a list and current documents, it is a formality. If it is met with «I would have to ask», the finding is no longer about the supplier: it is about you, because what has been demonstrated is that you did not know.
Worth knowing
What duties you carry over your suppliers depending on the service and the information, what must be agreed contractually and what regime applies to each link **is settled by your adviser**, and varies greatly between sectors and countries. Here we cover the organisational part: how to ask for it, how to keep it current and how to answer for the whole chain without phoning anyone.
›Must I require of my supplier what is required of me?
It is what closes the gap. How it is framed is for your adviser.
›What if my supplier is far larger than me?
It happens often, and then the leverage is choosing well at contracting.
›How often should this be reviewed?
Better than reviewing: be told when something falls due. Reviewing stops happening.
A real case
The situation
The client audits and asks about your suppliers by name.
What you do
- Keeps a file per supplier with their documentation
What you get
You answer with a list instead of an enquiry.
The situation
A supplier's document expires and affects what you promised.
What you do
- Warns about third-party expiries as it does your own
What you get
The gap closes before the question arrives.
The situation
Nobody knows who your supplier subcontracts to.
What you do
- Records the chain declared by each supplier
What you get
The chain is known before it is asked about.
The situation
What was required of the supplier was agreed verbally.
What you do
- Keeps what was agreed alongside the supplier's file
What you get
What is enforceable is demonstrable.
The situation
Each department contracts suppliers on its own.
What you do
- Gathers supplier files in a single place
What you get
There is one picture of the chain, not four.
The situation
Chasing suppliers for documentation is done by hand.
What you do
- Requests and chases automatically
What you get
The chain stays current without dedicating a person.
This article answers
- passing client requirements to my suppliers
- sub-processors and documentation
- my supplier does not meet what is asked of me
- controlling the supplier chain