Insights from a DCR Partners webinar with Raj Kohli, Founder and Managing Director of DCR Partners, and Ricky Martin, who oversees procurement operations for DLA Piper’s international business.
How do you balance supplier value and supplier risk?
Balance supplier value and risk by first defining what you need from a supplier, then applying risk management proportionate to that value. Organisations typically outsource for one of three reasons: capacity, capability or cost. Risk management should protect that value case, not run as a separate conversation.
Increasing regulatory pressure can push organisations toward a purely risk-based lens, where risk becomes a yes-or-no question rather than a matter of appetite. Ricky Martin warns against this: “To start with, you’ve got to clearly understand what you want to get from a supplier, which will then help you drive what risk management is applied.” Where a supplier adds more value to the business, the acceptable risk threshold may reasonably be higher.
Why doesn’t a blanket approach to supplier risk management work?
A blanket approach fails because suppliers vary enormously in criticality, spend and risk exposure, so applying the same checks to all of them wastes resources and frustrates the business. DLA Piper pays between 8,000 and 9,000 unique suppliers a year across its international business, which makes one-size-fits-all controls impractical.
Instead, organisations should segment and tier suppliers so that effort is concentrated where risk and value are highest.
What is a procurement “front door” and how does supplier segmentation work?
A procurement front door is a single intake route that all new supplier requests pass through, with a segmentation model that assigns each request an initial risk tier. At DLA Piper, segmentation starts with the category of supply. For example, technology suppliers receive more stringent scrutiny than a recruitment agency with a stable, well-understood profile.
The key is keeping the front door frictionless. Over-engineer it and you either overload supporting teams or force the business to complete “100 questions just to engage procurement.” Well-designed intake questions can generate an initial risk view without adding burden.
How do you make sure the right risk teams review a new supplier?
Use risk-based triggers built into a single workflow, so specialist teams are notified only when a supplier meets their criteria. At DLA Piper, intake answers can automatically trigger reviews by data privacy, information security, tax, AI governance and responsible business teams, each with its own logic.
A high-risk, high-value SaaS provider might trigger every team, while a low-risk supplier might only trigger data privacy. As Ricky puts it, teams are involved “because they need to be involved,” not because they received a blanket notification. This approach also creates a single source of truth instead of siloed systems and processes.
How long does it take to onboard a supplier?
Supplier onboarding can take anywhere from 24 hours to six months, depending on risk and criticality. A low-risk, low-value supplier can be set up within a day, while a critical supplier typically takes three to six months. Standard due diligence usually takes six to eight weeks, with contract negotiation often the longest stage.
Raj Kohli highlights the cost of this delay. If a strategic supplier takes six months to onboard and another six months to deliver value, “you’re almost talking about a 12 month cycle before you’ve got value.”
How should proof-of-concept (POC) suppliers be risk-assessed?
Proof-of-concept suppliers should go through a proportionate, dedicated workflow that covers essential due diligence without slowing the business down. This is especially important for AI tools, where a free three-month trial may still involve sending company data to a third party.
Best practice is to ring-fence the POC’s scope so it doesn’t introduce new risks, agree the business outcome it needs to prove, and require the full onboarding process if the supplier moves beyond the trial. Ongoing communication is critical: the business must engage procurement regardless of cost.
What contract clauses help manage supplier risk and resilience?
Resilience and business continuity clauses, defined service levels, response times, named points of contact and exit provisions are the most important contract terms for managing supplier risk. They matter most when something goes wrong, rather than on the “happy path” where everything runs smoothly.
Ricky shares a real example from a previous role. After a routine relationship review on a Friday with no red flags, they learned on the Monday that a supplier was folding. Because the contract set out continuity commitments, contacts and dedicated time, both parties knew exactly what to do, and service disruption was minimised until the supplier was acquired two weeks later.
Contracts can also set the tone for a partnership by stating openly that a supplier is critical and what both parties expect from the relationship.
How do you move from point-in-time to ongoing supplier assurance?
Move to ongoing assurance by combining continuous automated monitoring with structured supplier relationship management. Point-in-time assessments can leave organisations without visibility for 12 months to three years between reviews.
The first element is technology-driven monitoring, such as sanctions checks and adverse media alerts for all suppliers, plus cyber threat monitoring for critical and strategic suppliers. The second is a supplier management framework, backed by senior management, in which roadmaps, incidents and changes are discussed regularly. For example, regular engagement gave Ricky months of notice that a critical supplier was moving its contact centre overseas, allowing contingency arrangements to be agreed in advance.
What are boards and ExCos asking about suppliers?
Boards and executive committees increasingly want context on supplier risk, exposure and strategic fit, not just contract value and a RAG rating. At DLA Piper, around 60–70% of the approval form for critical and high-value suppliers now focuses on risks and the value the supplier delivers.
Executives are asking where a supplier fits into long-term objectives and what the organisation’s exposure is. This top-down challenge has also improved conversations with operational teams and shifted supplier relationships from transactional to partnership-based.
How is AI being used in procurement and supplier risk management?
AI is being used to automate quality checks, route workflows and, increasingly, assess low-risk contracts against defined playbooks. DLA Piper uses AI reviews to flag common discrepancies in intake forms before they progress, and is exploring AI agents that could review supplier terms against a contract playbook for low-risk cases.
Ricky notes that without AI and automation, managing a supply chain of this size “would be very difficult or I’d need a team of 100.” Governance remains essential. Use cases are agreed with AI governance, risk and general counsel teams, outputs are tested, thematic reviews continue after go-live, and anything outside risk thresholds is escalated to a human.
What if a technology supplier will only contract on its own terms?
Take a risk-based approach. Push back firmly for critical suppliers linked to important business services, and accept supplier terms after legal review where the risk is acceptable. If a critical supplier still refuses, treat this as a flagged risk and escalate it so the business can make an informed decision.
Either way, transparency matters. At DLA Piper, any use of supplier terms is flagged through the approval chain alongside the outcome of the legal review.
What are the key takeaways for managing supply chain risk while maximising value?
The key takeaways are to break down silos, build a single source of truth and use technology to free up time for higher-value supplier conversations. Collaboration between procurement, risk and specialist teams is the cornerstone. Consistent data means everyone sees the same picture and reaches the same conclusions.
As Ricky concludes: “Set the standards, collaborate, try and bring everyone together, reduce those silos, and you will find if you do that from the outset, the rest of the journey with that supplier will be better.”
Want to learn more about supply chain resilience and third-party risk? Contact DCR Partners at info@dcrpartners.co.uk or find out more here
