What to check when a supplier changes a subcontractor

A supplier's notice says it is replacing a subcontractor to improve service. The proposed date is close, and the notice assures customers there will be no material impact. Your review needs to establish what changes in the service you receive and what supports that assurance.

Start with a before-and-after view. A change of name may be administrative, while a new support team, data-access model or recovery process can alter assumptions the original review relied on.

The workflow below is an original review aid. Use the current CPS 230 standard, applicable contracts and the organisation's policies when deciding obligations. A supplier's contractual notice and the regulated entity's own notification assessment are separate matters.

Identify the change that reaches your service

In this fictional example, an insurer uses a managed claims application. Its direct provider plans to replace the specialist subcontractor that supports database recovery. The application, hosting location and customer-facing interface are said to remain unchanged.

That does not settle the review. The outgoing specialist helped perform the last recovery exercise. The incoming team will use a different support model and has not yet participated in a service-specific test.

The insurer asks the direct provider to identify the affected service, legal entities, implementation date, transition period and responsibilities moving between teams. It also asks what will remain unchanged and what evidence supports those statements.

All organisations and circumstances in this example are invented. The review questions should be adapted to the actual service, not treated as a fixed mandatory questionnaire.

Build a concise difference record

A difference record is more useful than two disconnected supplier profiles. For each relevant area, write the old position, proposed position, supporting evidence and unresolved question.

Service responsibility: Which tasks move, and which stay with the direct provider? Is the new team responsible for advice, execution or both?

People and capability: Which skills are required? How will the new team learn the service's configuration and known exceptions? What happens if specialist staff are unavailable?

Access and information: Will the new subcontractor see production records, diagnostic logs or credentials? Will it have privileged access? How will access be granted, monitored and removed?

Location: Where will support be performed? Consider staff access and service delivery, not only the location of stored data.

Continuity: Which recovery steps depended on the outgoing subcontractor? Does the revised plan use the same tools, permissions and escalation arrangements?

Transition: Is there overlap, a rollback option and a named person responsible for each handover? What must be demonstrated before the old arrangement ends?

Check the contract without assuming a veto

Ask the legal or contract owner which notice, consent, objection, audit and information rights apply. Do not assume every customer can prohibit every subcontractor change. Equally, do not assume a notice removes the need to assess the change.

Record relevant dates. An objection window may close before the technical team finishes its review. Bring that constraint to the decision-maker early, with the information available and the gaps that remain.

If the proposed change affects location, service scope or a material arrangement, have the appropriate owners assess any regulatory consequences. Not every subcontractor substitution has the same notification treatment. An acknowledgement sent to the supplier should not accidentally communicate acceptance if the review is still open.

APRA's CPG 230 guidance provides broader context for ongoing service-provider risk management. The practical question here is narrower: which earlier conclusion may no longer be supported after this change?

Request evidence for the changed assumption

In the fictional recovery-support change, a general capability presentation is not enough. The insurer needs evidence about the incoming team's ability to support this application.

The direct provider proposes a handover workshop. That may help transfer knowledge, but attendance does not demonstrate recovery capability. The insurer asks for a controlled walkthrough covering the relevant recovery steps, permissions, escalation contacts and division of responsibility.

Use synthetic data or another authorised test arrangement. The review does not itself authorise sharing customer information or access credentials with a new party.

The test finds that the incoming specialist can diagnose the problem but lacks permission to run a required recovery operation. The direct provider assumed the subcontractor would execute it; the subcontractor assumed the provider would. This is a responsibility gap, not merely a training issue.

The action names who will perform the step, who will authorise it and what evidence will demonstrate the revised arrangement works.

Give the decision-maker options

A review that only says “more evidence needed” can leave the business without a usable decision. Explain the consequence of the gap and the feasible options.

In this example, options might include delaying the affected handover, retaining limited overlap with the outgoing specialist, narrowing the incoming team's initial role or completing a specific test before cutover. These are hypothetical options, subject to availability, contract rights and appropriate approvals.

Do not present a workaround as available merely because it would solve the problem. Confirm its people, access, cost and operational feasibility before relying on it.

The decision record should distinguish accepted evidence, unresolved risks, required conditions and the person authorised to decide. Risk acceptance does not make an unmet legal obligation disappear.

Verify what actually changed

After implementation, compare the live arrangement with the reviewed proposal. Confirm the correct entity and team are providing the service, access matches the approved scope and escalation contacts work.

Check that the outgoing party's access and information are handled under the applicable retention, security and contractual arrangements. Avoid blanket deletion instructions that ignore records the organisation must retain.

For the fictional insurer, closure requires evidence that the recovery operation can be performed by the agreed team and that the revised contact route reaches the right people. A supplier statement that transition is complete is an input to that check, not its substitute.

Update the records people will use

The dependency map, service record, continuity plan and action log should tell the same story. If one still names the outgoing specialist, incident responders may call the wrong team during a disruption.

Keep the original notice, the difference record, review evidence, decision and post-change check together. Note which conclusions need reassessment if the support model changes again.

Use fourth-party mapping to locate the changed dependency; if delivery or access moves overseas, apply the separate offshoring review questions.

The next time a notice arrives, ask the service owner one concrete question: “Which part of our last assessment or recovery test relied on the outgoing subcontractor?” That answer gives the review a useful starting point.