Turn a supplier acquisition notice into a risk review

A supplier announces an acquisition and says customers will see no immediate change. The relationship manager forwards the message, procurement updates the ownership field and the risk review waits until renewal.

The useful question is what may change in the arrangement your organisation relies on. Ownership is one fact. The service model, legal entity, technology, people and dependencies may change on different dates, or may remain unchanged.

This article provides a suggested review method for a fictional acquisition scenario. It does not assume an acquisition creates a service failure or automatically triggers every notification requirement.

Separate announcement, completion and integration

Record whether the transaction has been announced or completed, and what the supplier has actually confirmed. Avoid treating a proposed integration plan as an implemented change.

Establish the contracting entity and ask whether it will remain the same. Then identify the people responsible for explaining operational changes and the timetable for further information.

A short change log can distinguish:

• Confirmed facts, with their source and date.
• Proposed changes awaiting a decision or implementation.
• Questions still unanswered.
• Assumptions your organisation is currently making.

This prevents a broad assurance such as “business as usual” from replacing a review of the particular service.

Identify the decisions that depend on the change

Ask whether the information could affect a renewal, planned migration, continuity assumption or risk assessment. Prioritise questions that matter to those decisions.

CPS 230 contains requirements for material changes to arrangements and for relevant notifications. The acquisition notice alone does not establish which requirements apply. Have the appropriate risk and legal owners assess the actual proposed changes against the current provisions and contract.

This is especially important where an integration may alter where services are performed, who accesses data or which subcontractors are used. Do not wait for the next annual review if a decision is required earlier.

Work an acquisition with a phased integration

Consider a fictional insurer using a specialist claims-support provider. The provider is acquired by a larger group. The initial notice confirms that the contracting entity remains unchanged and that existing service contacts will continue for now.

A later update proposes moving support to a shared team and migrating the service to another platform. These are separate changes with different evidence needs.

For the support change, the insurer asks about capability, availability, escalation and continuity. For the platform migration, it asks about testing, data handling, dependencies, recovery and acceptance. The insurer does not treat the unchanged legal entity as proof that operational risk is unchanged.

The change log records what is confirmed, the proposed dates and the evidence still needed. Each item has an owner who can assess its consequence for the insurer's service.

Ask service-specific questions

A focused request can cover the areas most relevant to the arrangement:

• Will the service scope, service levels or escalation contacts change?
• Which key personnel or delivery teams will change, and how will knowledge transfer be handled?
• Will data access, hosting, service location or subcontractors change?
• Which existing controls and assurance reports remain applicable?
• How will continuity and recovery arrangements work during integration?
• What testing and customer acceptance steps are proposed?

Ask for the evidence supporting the answers and the route for notifying later changes. Avoid requesting a complete corporate integration plan if a narrower service-specific explanation would answer the assessment question.

APRA's CPG 230 includes strategic changes among matters considered in periodic review of material arrangements. The questions above are practical suggestions for exploring a particular change, not a regulator-issued acquisition checklist.

Review the contract through the appropriate specialists

Have legal review relevant assignment, change-of-control, notice, subcontracting and termination provisions as applicable to the actual contract. Their meaning and effect depend on the agreement and circumstances.

The risk team can explain the operational concern and the evidence needed. It should not infer a right to terminate or a need for consent from the acquisition headline alone.

Keep contractual rights connected to practical options. If an alternative service cannot be introduced safely within the available period, that constraint belongs in the decision record. A contractual option may still require planning, resources and a tested transition approach.

Do not carry old assurance forward automatically

An assurance report for the previous environment may remain useful for a limited period or scope. Identify what changed before relying on it for the integrated service.

For example, a report covering the original support team may not demonstrate controls in a newly shared operation. A migration test may show successful data transfer while leaving restoration or reconciliation assumptions untested.

Record the boundary of the evidence and agree what will establish the new position. This helps the team avoid both discarding useful material unnecessarily and claiming coverage it does not provide.

Follow through after the change

Pre-change assurances need to be compared with what was implemented. Check the agreed service indicators, confirm key contacts and dependencies, and review the evidence of testing or acceptance.

If implementation differs from the proposal, assess the difference explicitly. Keep unresolved issues visible with an owner, due date and escalation route. Do not close the review solely because the acquisition has completed.

Follow changes in the delivery chain through the subcontractor-change review, then use the register-maintenance workflow to update the relevant records without losing the history.

Use the evidence checklist to connect notices, follow-up answers and decisions. The immediate next step after an acquisition announcement is a clear service-specific question: what will change in this arrangement, when, and what evidence will let us assess it?