The Low-Spend Single Point of Failure
A logistics company has 63 IT suppliers. Procurement has segmented them by annual spend: 5 strategic suppliers above $1 million, 18 preferred suppliers between $100,000 and $1 million, and 40 tactical suppliers below $100,000. Governance follows spend: strategic suppliers get quarterly executive reviews, tactical suppliers get an annual invoice check. The identity and access management SaaS provider sits in tactical at $70,000 per year, but all 9,000 employees and 1,200 partner accounts use it for authentication; it is the only provider with no viable alternative, and its outage in February stopped warehouse scanning for 4 hours. The provider has had two security incidents in 12 months and is due for renewal in 6 months. The CISO wants it moved to strategic; procurement says spend-based segmentation is objective and consistent.
1. Assess procurement's argument that spend-based segmentation is objective and consistent. What is wrong with the current classification?
Read the worked answer
Spend is objective, but objectivity is not the same as fitness for purpose. The segmentation governs risk and attention, so it must reflect value, criticality, dependency, substitutability, and risk, not only annual spend. The IAM provider is low spend but high criticality: it authenticates 9,000 employees and 1,200 partners, has no viable alternative, caused a 4-hour warehouse scanning stoppage, and has had two security incidents in 12 months. Treating it as tactical with only an annual invoice check leaves the company blind to a single point of failure. Procurement's consistency argument also hides an inconsistency: the company is applying a financial proxy to a service continuity and security decision. The supplier may not need to be called strategic in the sense of innovation or business advantage; it may better fit a critical or high-risk category. Either way, the current label is wrong because the governance does not match the exposure.
2. Propose a revised segmentation approach and specific governance actions for the IAM provider.
Read the worked answer
Use a two-dimensional model: business value or criticality on one axis and supply risk or dependency on the other, with spend as supporting data rather than the deciding factor. Classify the IAM provider as critical/high-risk. Governance should then include monthly service and security reviews, an executive sponsor, contractual security requirements and incident notification, evidence of independent security testing, a documented business continuity and recovery test, a roadmap for authentication changes, and a viable exit or substitution plan. Because renewal is in 6 months, the company should start a renewal strategy now, including benchmarking, liability and breach terms, and an assessment of whether a second authentication path is feasible. The annual invoice check should remain, but it must not be the only control. This changes attention and risk treatment without pretending that every low-spend supplier deserves executive time.