There is a particular kind of quiet that falls over a room when a regulator asks a question nobody in it can fully answer.
It usually is not a technical question. It is something closer to: “Which of your critical suppliers would cause the most disruption if they failed tomorrow, and what would you do about it?” Everyone in the room knows the organisation has an answer somewhere. The trouble is that “somewhere” means three different systems, a handful of spreadsheets last updated by someone who has since changed roles, and a contract repository that only the legal team can search with any confidence.
This is not a hypothetical scenario dreamed up for a LinkedIn post. It is close to the exact position a lot of financial services procurement and risk teams found themselves in as DORA moved from a regulation on a slide to a set of obligations with real deadlines. The Digital Operational Resilience Act asks firms to maintain a register of information for their ICT third-party arrangements, to understand and monitor supplier criticality, and to have contracts that hold up under scrutiny, covering exit rights, audit access and notification obligations. None of that is unreasonable. All of it assumes the organisation can actually see its own supplier landscape clearly enough to answer.
Most cannot, not because anyone has been careless, but because the systems were never built to answer that question. Sourcing decisions get made in one place. Contracts get negotiated, signed and filed in another. Risk assessments happen on a schedule that has little to do with how contracts get renewed or suppliers get onboarded. Over years, an organisation accumulates a genuinely enormous amount of information about its suppliers. It just accumulates it in a form that nobody can query in the ten minutes before a board meeting.
The instinct, understandably, is to treat this as a compliance project: build a register, tick the DORA box, move on. That instinct is not wrong, but it undersells what is actually possible here. The same connected view that satisfies a regulator also answers a much more useful, everyday question: where is this organisation exposed, right now, and what is it doing about it. Supplier criticality stops being an annual spreadsheet exercise and becomes something that updates as contracts change and new suppliers are onboarded. Contract obligations, the notification clauses, the audit rights, the exit provisions, become things a system can actually track and flag, rather than terms buried in a PDF that only gets reopened when something has already gone wrong. Concentration risk, several critical processes quietly depending on the same supplier or the same fourth party underneath them, becomes visible before it becomes a headline.
None of this is about replacing judgement with software. Somebody still has to decide what counts as critical, still has to negotiate the right contract terms, still has to decide what an acceptable exit plan looks like. What changes is whether that judgement is working from a complete picture or a partial one, and whether the answer to the regulator’s question takes ten minutes or ten days to assemble.
We have spent a long time building and implementing Source-to-Pay platforms for organisations that need exactly this: a single, connected view of suppliers, sourcing, contracts and risk, so that the next time someone asks the hard question, the answer is already sitting there, current and ready to be shown. It is the kind of work that has seen TSM shortlisted for the CIPS Procurement Consultancy Project of the Year and the WPA Best Procurement Consultancy Project award, recognition we put down to exactly this: solving unglamorous problems that turn out to matter a great deal.
