Supplier management I: strategy, selection and contracts

Larchmont Technology Services cannot deliver a single business service on its own. The shipment portal runs in a public cloud. The distribution centres connect through a carrier's network. The warehouse management system is licensed from a software vendor, which also provides support. Security monitoring is outsourced to a managed security provider. Laptops come from a hardware reseller with a repair contract. When any of these suppliers fails, Larchmont's customers feel it. Supplier management is the practice that makes sure suppliers, and their performance, support the services LTS promises.

ITIL-130 lesson 11 introduced partners and suppliers in the value system: sourcing models, classifying suppliers by risk and value, service integration and management (SIAM) layers and exit planning. This lesson and the next look at supplier management as a practice. This lesson covers its purpose and activities, supplier strategy, selection and due diligence, contract design, commercial models and key clauses, and the legal and procurement context. Lesson 10 covers performance, risk and multi-supplier management.

Purpose of supplier management

In plain words, the purpose of the supplier management practice is to ensure that the organization's suppliers and their performances are managed appropriately to support the seamless provision of quality products and services. This includes creating closer, more collaborative relationships with key suppliers to uncover and realize new value and reduce the risk of failure. The words seamless and collaborative are important. Users should not be able to see where one supplier's responsibility ends and another's begins. And for key suppliers, the aim is not only to police a contract but to work together to improve.

Supplier management is a general management practice in ITIL 4. Published summaries of ITIL (Version 5), checked in October 2026, keep supplier management in the general management group.

Activities of the practice

ITIL describes the key activities of supplier management as: creating a single point of visibility and control to ensure consistency; maintaining a supplier strategy, policy and contract management information; negotiating and agreeing contracts and arrangements; managing relationships and contracts with internal and external suppliers; and managing supplier performance. The first activity is often overlooked. In many organizations, contracts are signed by different departments, stored in different places and managed by nobody in particular. A single supplier and contract register, with owners for each supplier, is the foundation of everything else.

Supplier strategy

A supplier strategy sets the direction for how the organization uses suppliers. It draws on the organization's overall strategy and the sourcing factors discussed in ITIL-130: which capabilities are core and should stay in-house, which are better sourced, how much dependence on any one supplier is acceptable, what the organization's approach is to cloud, and how suppliers should support goals such as security, accessibility, sustainability and local economic benefit. The strategy guides decisions about individual contracts so they add up to a coherent whole.

For Larchmont, the supplier strategy might say: keep warehouse process knowledge and integration skills in-house; use public cloud for customer-facing services; avoid single-supplier dependence for network connectivity at the largest distribution centres; prefer suppliers with independent security assurance; and include environmental criteria in hardware purchasing.

Segmenting suppliers

Not every supplier deserves the same attention. ITIL-130 introduced the purchasing portfolio matrix, which classifies suppliers by business impact and supply risk. Supplier management uses segmentation to decide how much effort to spend on each supplier. A common segmentation uses three or four tiers: strategic suppliers, whose failure would seriously harm critical services and with whom the organization seeks partnership; tactical suppliers, important but replaceable with some effort; operational suppliers, providing standard products or services; and commodity suppliers, easily replaced and managed mainly through purchasing.

Selecting suppliers

Supplier selection should be structured and fair. A typical process starts by defining requirements: what is needed, the service levels, security and privacy requirements, integration needs and constraints. The organization may issue a request for information (RFI) to learn about the market, then a request for proposal (RFP) asking suppliers to describe how they would meet the requirements and at what price. Proposals are evaluated against criteria defined and weighted before proposals arrive, to avoid bias. Shortlisted suppliers may give demonstrations, provide references and answer due diligence questions. The organization then negotiates with the preferred supplier.

Price matters, but rarely alone. Criteria usually include functional fit, service levels, security and privacy, financial stability, references and track record, implementation approach, support model, exit arrangements and total cost over the contract life.

# Weighted proposal evaluation with a sensitivity check on the weights
criteria = ["capability", "assurance", "service", "price", "exit"]
weights = [0.30, 0.20, 0.20, 0.20, 0.10]
scores = {"P": [8, 9, 7, 6, 8], "Q": [9, 7, 8, 8, 5], "R": [7, 8, 9, 9, 7]}

def total(w):
    return {s: sum(a * b for a, b in zip(w, v)) for s, v in scores.items()}

base = total(weights)
print("base weights:", {k: round(v, 2) for k, v in sorted(base.items(), key=lambda x: -x[1])})
# Shift 10 points of weight from price to each other criterion in turn and see if the winner changes
for i, c in enumerate(criteria):
    if c == "price":
        continue
    w = weights[:]
    w[3] -= 0.10
    w[i] += 0.10
    t = total(w)
    winner = max(t, key=t.get)
    print(f"price -10 pts, {c:<10} +10 pts: winner {winner}  " + "  ".join(f"{k}={v:.2f}" for k, v in sorted(t.items())))

base weights: {'R': 8.0, 'Q': 7.8, 'P': 7.6}
price -10 pts, capability +10 pts: winner Q  P=7.80  Q=7.90  R=7.80
price -10 pts, assurance  +10 pts: winner P  P=7.90  Q=7.70  R=7.90
price -10 pts, service    +10 pts: winner R  P=7.70  Q=7.80  R=8.00
price -10 pts, exit       +10 pts: winner P  P=7.80  Q=7.50  R=7.80

The sensitivity check shows whether the decision depends heavily on a particular weighting. Here it does: shifting just 10 points of weight away from price changes the winner in three of the four cases. If moving a small amount of weight from price to capability changes the winner, the evaluation team should discuss which criterion truly matters more before committing to a multi-year contract.

Due diligence

Due diligence checks that a supplier is what it claims to be and can be trusted with the organization's services and data. It typically covers financial health, ownership, legal and regulatory history, security controls, privacy practices, business continuity and disaster recovery arrangements, subcontractors (sometimes called fourth parties), insurance, and references from comparable customers. For suppliers that will handle sensitive data or support critical services, independent assurance reports such as SOC 2 or ISO/IEC 27001 certification are commonly requested. Lesson 10 explains these reports.

Contract structure

A contract for IT services usually has a master agreement containing the legal terms and several schedules or exhibits covering the service description, service levels and KPIs, pricing, security and data protection, governance and reporting, change control, transition in and transition out. Keeping the service and commercial details in schedules makes them easier to update through a contract change process without renegotiating the legal terms.

Commercial models

How a supplier is paid shapes how it behaves. In a fixed-price model, the supplier delivers a defined scope for an agreed price, which gives the customer cost certainty but transfers risk to the supplier, who will price that risk in and resist scope changes. In a time and materials model, the customer pays for effort used, which is flexible but gives the supplier little incentive to be efficient. In a consumption or unit-based model, common in cloud services, the customer pays per unit used, such as per user, per virtual machine hour or per transaction, which aligns cost with use but can surprise the customer when volumes grow. In an outcome-based model, payment depends partly on achieving business outcomes, which aligns incentives strongly but requires outcomes the supplier can influence and both sides can measure.

Key clauses for service managers

Service managers do not draft contracts, but they should know which clauses affect service delivery and make sure those clauses work in practice. Service levels and credits must be measurable and aligned with the SLAs they underpin. Notification clauses should require suppliers to report incidents, security breaches and planned changes promptly. Audit and information rights let the customer verify controls. Subcontracting clauses control whether the supplier can pass work to others. Data clauses specify where data is stored, how it is protected and how it is returned or destroyed. Termination and exit clauses set out the circumstances for ending the contract and the help the supplier must give in transferring services. Step-in rights, more common in large outsourcing deals, allow the customer to take over a failing service temporarily.

A recurring gap is the mismatch between contract terms and operational reality. A contract might promise a four-hour response for critical incidents, but if the supplier's support line is not integrated with LTS's incident management and nobody knows the escalation route, the clause is worth little at 02:00.

Procurement and legal context

In Canada, public-sector buyers must follow procurement rules that promote fair, open and transparent competition. Federal departments buy through Public Services and Procurement Canada (PSPC) and must respect trade agreements such as the Canadian Free Trade Agreement, CUSMA and the Canada–EU CETA where they apply. Provincial and municipal bodies follow their own rules and agreements. Private-sector organizations have more freedom but often adopt similar practices. On privacy, PIPEDA's accountability principle makes an organization responsible for personal information it transfers to a supplier for processing, which it must protect through contractual or other means; Quebec's Law 25 adds requirements such as privacy impact assessments before transferring personal information outside Quebec. Federally regulated financial institutions must also meet OSFI Guideline B-10 on third-party risk management, covered in lesson 10.

Legal advice is needed for contract drafting and regulatory interpretation. The service manager's job is to make sure the operational realities of a service are reflected in the contract and that the contract is then managed actively.

Managing the contract lifecycle

Contracts have lifecycles: drafting, signature, onboarding, operation, renewal or renegotiation, and termination. Missing a renewal date can lock an organization into another year on poor terms, because many contracts renew automatically unless notice is given months in advance. A contract register with alerts for notice deadlines is a simple but valuable tool.

# Contract register: flag notice deadlines falling in the next 120 days
from datetime import date, timedelta
today = date(2026, 10, 1)
contracts = [
    # supplier, tier, end date, notice period (days), auto-renews
    ("Network carrier", "tactical", date(2027, 3, 31), 90, True),
    ("Managed security provider", "tactical", date(2027, 1, 31), 60, True),
    ("WMS vendor support", "strategic", date(2027, 6, 30), 180, False),
    ("Laptop repair", "operational", date(2026, 12, 31), 30, True),
    ("Cloud commitment", "strategic", date(2027, 9, 30), 0, False),
    ("Printer maintenance", "operational", date(2027, 2, 28), 60, True),
]
print(f"{'supplier':<28}{'tier':<12}{'notice by':<12}{'days left':>9}  action")
for name, tier, end, notice, auto in sorted(contracts, key=lambda c: c[2] - timedelta(days=c[3])):
    deadline = end - timedelta(days=notice)
    left = (deadline - today).days
    flag = "DECIDE NOW" if 0 <= left <= 120 else ("passed" if left < 0 else "")
    renew = "auto-renews" if auto else "expires"
    print(f"{name:<28}{tier:<12}{deadline.isoformat():<12}{left:>9}  {renew} {flag}")

supplier                    tier        notice by   days left  action
Laptop repair               operational 2026-12-01         61  auto-renews DECIDE NOW
Managed security provider   tactical    2026-12-02         62  auto-renews DECIDE NOW
Printer maintenance         operational 2026-12-30         90  auto-renews DECIDE NOW
Network carrier             tactical    2026-12-31         91  auto-renews DECIDE NOW
WMS vendor support          strategic   2027-01-01         92  expires DECIDE NOW
Cloud commitment            strategic   2027-09-30        364  expires