Set supplier review priorities when the risk team is small

Six supplier reviews are waiting. Two reviewers are available. The highest-spend contract is easy to identify, but the most urgent decision concerns a much smaller supplier whose service has changed without a tested fallback.

A review queue should make that difference visible. Spend can help describe a relationship, but it does not tell you which work must happen first to protect a critical operation or resolve an immediate uncertainty.

An ISACA practitioner article on third-party resilience similarly recommends classifying suppliers by access, data sensitivity and business importance so limited assurance resources can be directed toward higher-risk relationships. The queue below turns that general principle into a set of explicit review decisions.

This article presents an original qualitative triage method for lean Australian risk teams. It sits alongside the organisation's obligations under CPS 230 and its own approved policies. It does not change materiality, extend regulatory deadlines or justify leaving serious control failures untreated.

Keep classification and scheduling separate

Materiality asks what the organisation relies on and what risk a relationship creates. Review priority asks what work should happen next, given the current facts and available capacity. Combining the questions can produce a misleading result: a provider may be material even when its next routine review is not the most urgent task today.

Use separate fields for classification, review reason and priority. Record any mandatory deadline or decision date before applying discretionary triage.

An organisation with fewer than 200 staff may need a compact workflow, but its headcount is not a regulatory exemption or proof that it is a non-SFI. Check the entity's actual position rather than letting a commercial audience label become a compliance conclusion.

Work a queue with competing demands

The following queue is fictional. Riverbank Finance has two people coordinating supplier reviews, supported by service owners and specialists when needed.

• A payment-processing provider has changed a recovery dependency. The service owner cannot yet explain whether the fallback still works.
• An office supplier has the largest upcoming purchase renewal, with no identified connection to a critical operation or material risk in this example.
• A claims-related provider has an overdue action affecting how exceptions are escalated.
• A core application provider is due for a routine evidence refresh, with no reported service change and current supporting assurance.
• A communications provider is approaching renewal, and the contract decision needs legal input before the notice deadline.
• A new analytics service is proposed, but its intended data access and business use remain unclear.

There is no universal correct order without further facts. The point of triage is to expose those facts, not hide judgment inside a numerical score.

Apply three lenses

Consequence: What service, customer outcome or obligation could be affected? Is the concern already happening, or is it a future possibility? What would be hard to recover if the decision is delayed?

For the payment provider, the unresolved recovery dependency affects a service the organisation needs to sustain. For the office supplier, high spend does not by itself establish the same operational consequence.

Change: What is different since the last assessment? A change to delivery location, subcontractor, ownership, system or service scope can invalidate earlier conclusions. Identify the actual change rather than treating every notice as equally important.

Evidence uncertainty: What important claim is unsupported, contradicted or out of date? A large document pack can contain a serious gap; a small pack can answer a narrow question well. Judge the evidence against the decision being made.

Use these lenses as prompts. Do not add arbitrary points and describe the result as an objective risk rating unless the organisation has approved and validated that approach.

Give each review a decision-sized next step

Riverbank does not need to finish six full questionnaires before learning what matters. It assigns bounded first actions.

For the payment provider, technology checks the changed dependency and requests the relevant recovery evidence. Risk and the service owner decide whether interim measures or escalation are needed while the answer is pending.

For the claims-related provider, operations checks whether the overdue action is still open and whether the exception process is failing now. If there is current impact, the issue moves into the relevant incident or remediation process rather than staying in a routine review queue.

For the communications renewal, legal confirms the decision deadline and the consequences of missing it. A date-sensitive commercial decision can need immediate attention even if no new operational issue has been identified.

For analytics, the sponsor must define the use case and data access before the team can assess the proposal. “Insufficient scope” becomes an assigned task, not a permanent reason to leave the item untouched.

Record why work waits

A defensible queue includes reasons for deferral. “Low priority” says little. A useful entry names the current evidence, the next review date or event, the owner and the conditions that would bring the work forward.

For the core application provider, Riverbank records that the routine refresh can wait briefly because the relevant evidence remains current and no material change is known. It names the service owner who will report incidents or changes in the meantime. That is a bounded scheduling decision, not a claim that the provider is risk-free.

For the office supplier, the procurement owner continues the commercial review while risk confirms the limited service scope described in this example. If the scope expands into a critical operational dependency, the earlier triage no longer applies.

APRA's CPG 230 guidance is a useful reference when aligning the review process with service-provider management. The queue should support that process, rather than become a separate set of unofficial rules.

Allow reasoned overrides

A senior owner may know something the initial triage missed. Make overrides possible, but require the reason and consequences to be recorded.

If an executive brings the office contract forward, ask which other task will move and whether its timing can safely change. The answer may be additional resources rather than quietly delaying the payment-provider enquiry.

Likewise, allow reviewers to escalate a small-looking item when new evidence reveals greater consequences. Priority should change with facts. It should not depend on who sends the most reminders.

Review the queue as a capacity decision

At a short regular review, discuss what changed, what is blocked, what decisions are due and where specialist capacity is needed. Choose the cadence to match the work; this article does not prescribe a regulatory frequency.

Track time spent waiting for information separately from time spent reviewing. A queue full of “in progress” items may reflect unanswered supplier questions, missing business scope or unavailable legal input. Each blocker needs a different response.

Keep the final record simple: provider and service, reason for review, consequence, change, evidence gap, decision date, next action, owner and reason for any deferral. The evidence checklist can help organise the supporting material.

When priorities or deferrals need senior approval, the board-report guide helps turn the queue into a clear decision request rather than a list of overdue reviews.

Start with the next ten items in the real queue. For each, finish the sentence: “The next decision we need is…” Any item that cannot answer it needs a clearer scope before it needs a longer questionnaire.