TL;DR
- Giga-project supplier risk is a network problem: one provider or subcontractor may support several work packages, systems, or critical milestones.
- Effective third-party risk management connects supplier dependencies to risk-based assessments, evidence, accountable owners, and follow-up throughout the relationship.
- 6clicks supports this lifecycle through vendor assessments and monitoring, risk and issue tracking, and Intelligent evidence validation, with decisions remaining in human hands.
A supplier list is not a risk picture
Picture this: a specialist contractor is approved for one workstream. Months later, another team engages the same provider for a different service. Both relationships appear on a supplier list, but neither record shows the full dependency or whether the original assessment covers the new scope.
For a giga-project, an exceptionally large development involving multiple projects and delivery partners, that distinction matters. Contractors, subcontractors, technology providers, and logistics partners can introduce delivery, financial, safety, cyber, and compliance risks across multiple interfaces.
The question for programme leaders is not simply “Who are our suppliers?” It is “Where do we depend on them, what could go wrong, and can we demonstrate how those risks are being managed?”
Why the supply chain needs a programme-wide view
The practical implication is that a supplier problem can reach beyond the contract where it first appears. A delayed specialist component could affect several work packages; a technology provider with access to shared systems could create exposure across more than one team.
A programme-wide view helps leaders see those connections before they become a milestone decision.
Five steps for stronger third-party risk management
|
GIGA-PROJECTS / THIRD-PARTY RISK A practical supplier assurance cycle Connect each dependency to evidence and an accountable decision.
Review decisions should remain with accountable people. |
1. Map dependencies, not just names
Record the service or package each third party provides, the project areas that depend on it, its owner, and any critical subcontractors that can reasonably be identified. Note shared suppliers and single-source dependencies.
A register is a starting point. Its value increases when teams can see which milestones, assets, or systems depend on a supplier—and who is accountable for the relationship.
2. Prioritise by risk and criticality
Not every supplier needs the same depth of review. Consider the potential impact of failure, access to sensitive data or systems, substitutability, service criticality, and the breadth of the dependency. Use these factors to set an assessment depth and review cadence.
For example, a supplier providing routine office materials may warrant a lighter process than a sole-source provider supporting a critical facility. Risk ratings should guide attention, not replace professional judgement.
3. Assess evidence before relying on it
Ask for evidence appropriate to the service: relevant certifications, security assessments, continuity plans, delivery commitments, or financial information. Check whether each item covers the right entity, service, period, and control. A certificate alone does not demonstrate every control, and a supplier’s statement may need further review or independent verification.
For Saudi organisations, cybersecurity requirements may also apply. The National Cybersecurity Authority’s 2026 ECC implementation guide discusses assessing cyber risk when planning to acquire third-party services. Its scope follows ECC-2:2024, and covered entities include specified government organisations and private-sector owners, operators, or hosts of critical national infrastructure. Assess applicability; not every project or supplier is automatically in scope.
4. Turn findings into owned actions
A completed assessment is not the end of the process. Record material gaps, potential impact, the responsible internal or supplier owner, target date, and escalation route. If a risk is accepted, document who approved it and for how long.
Before a milestone, the decision-maker should be able to see whether critical actions are complete, what remains open, and whether progression is conditional on further work.
5. Reassess when the relationship changes
A new subcontractor, expanded service, incident, expired evidence, or material change in access may alter the risk. Define the events that trigger review, alongside a risk-based reassessment schedule. A supplier approved for one scope should not automatically be treated as approved for another.
What this looks like in practice
Imagine a fictional provider responsible for a control system used across two facilities. The procurement team has a completed assessment, but the second facility introduces remote access and a subcontractor not covered in the original review.
The relationship owner updates the dependency record, requests evidence for the changed service, and asks security to review the access arrangements. A finding remains open, so the programme records an owner, a due date, and an interim restriction before the next gate. Leadership can then make a decision with the unresolved risk visible.
This provides a way to connect reviews to the relevant supplier and decision.
How 6clicks supports the supplier risk lifecycle
6clicks Vendor Risk Management helps teams manage onboarding, assessments, remediation, and ongoing monitoring in one connected environment. Teams can use tailored assessments, link them to controls and obligations, and raise and track risks or issues with internal and supplier owners.
6clicks Intelligent GRC helps connect controls, tests, evidence, and assurance activities. It supports continuous control monitoring and AI-assisted evidence validation against defined test criteria. Reviewers can examine potential gaps and decide what needs follow-up; AI does not approve suppliers or replace human accountability.
The goal is not to promise that every disruption can be prevented. It is to give risk, procurement, and programme teams a clearer basis for consistent review and escalation.
Start with your most critical dependencies
Choose a small group of suppliers supporting a high-impact milestone. Map the services and workstreams that depend on them, check whether existing evidence matches the current scope, and identify open findings and owners. Then agree when the next review should happen.
As the ecosystem grows, that repeatable discipline helps turn a supplier list into an evidence-backed view of third-party risk.
Explore 6clicks Vendor Risk Management to connect supplier assessments, risks, and follow-up.
