ITIL 4 Supplier Mgmt cheat sheet

Suppliers are external parties that provide products, services, or resources; supplier management ensures they meet agreed value, quality, and risk expectations.

ITIL 4 places supplier management in the Service Value Chain activity 'Obtain/acquire' and in the 'Supply' value stream, not as a standalone lifecycle stage.

Key principle: value is co-created with suppliers, so relationships are managed for outcomes, not just contract compliance.

Third-party risk is part of the organization's overall risk profile; a supplier failure is the organization's failure to its customers.

Focus on 'value co-creation' means suppliers are part of the service value system and must align to the organization's objectives.

The four dimensions (organizations and people, information and technology, partners and suppliers, value streams and processes) all apply to supplier management.

Supplier management interfaces with incident, problem, change, and service level management; escalations must follow defined paths.

Distinguish supplier (external provider) from partner (shared risk/reward) and from customer (recipient of value).

Guiding principle 'collaborate and promote visibility' applies directly: share roadmaps, performance data, and risk information with suppliers.

Supplier strategy must derive from the organization's strategy and service value chain; no strategy means ad hoc sourcing and uncontrolled risk.

A supplier policy defines principles, roles, approval authorities, and mandatory controls; it is approved at executive level and reviewed periodically.

Make-or-buy (sourcing) decisions weigh cost, capability, control, risk, and strategic importance; outsourcing is not automatically cheaper.

A supplier strategy sets objectives such as resilience, cost optimization, innovation access, and regulatory compliance.

Policy must cover onboarding, due diligence, contract approval, performance review, and exit/termination.

Define decision rights: who can approve a new supplier, who can sign a contract, who can terminate, and who owns the relationship.

Align supplier policy with procurement, legal, security, and finance policies; conflicts must be resolved at the governance level.

Set risk appetite for supplier concentration (single-source dependency) and geographic/regulatory exposure.

Policy should require a business case for strategic suppliers, including total cost of ownership, not just unit price.

Segmentation groups suppliers by strategic importance, spend, risk, and dependency so management effort matches value and exposure.

Common model: strategic, tactical, commodity, and niche suppliers; strategic suppliers get relationship management, commodities get transactional management.

Kraljic-style matrix: classify by profit impact (spend/value) and supply risk (availability, substitutability).

Single-source or sole-source suppliers are high risk; require contingency plans and closer monitoring.

Categorization by spend (ABC analysis) helps prioritize negotiation and contract review effort.

Risk-based segmentation considers financial stability, security posture, regulatory exposure, and geographic concentration.

Segment drives the relationship model: strategic = executive sponsor and joint roadmap; commodity = catalogue and self-service ordering.

Re-segment periodically; a supplier's importance changes with business strategy, market shifts, and performance.

Document segment criteria and keep a supplier register (inventory) with owner, segment, contract dates, and risk rating.

Lifecycle: identify need, evaluate/select, due diligence, contract, onboard, manage performance, review, renew or exit.

Due diligence before contracting covers financial health, security, compliance, references, and business continuity capability.

Contract must define scope, service levels, KPIs, pricing, responsibilities, data protection, termination, and dispute resolution.

Service level agreements (SLAs) with suppliers should mirror internal SLAs and customer commitments (back-to-back alignment).

Contract management tracks obligations, milestones, renewals, price reviews, and change requests; missed renewal dates create risk.

Change control: any scope or price change goes through a documented change process, not informal agreement.

Exit planning is part of contract management: data return, transition assistance, knowledge transfer, and termination notice.

Maintain a contract register with key dates, owners, value, and obligations; review before auto-renewal.

Onboarding includes access provisioning, security requirements, contact matrices, escalation paths, and performance baselines.

Relationship management is continuous: regular reviews, joint improvement plans, escalation, and honest performance dialogue.

Performance measurement uses KPIs and SLAs; metrics must be specific, measurable, and tied to business outcomes.

Typical measures: availability, response/resolution time, quality, cost, compliance, customer satisfaction, and defect rate.

Service reviews (operational) and business reviews (strategic) are separate cadences with different audiences.

Scorecards and dashboards make performance visible; trends matter more than single-period results.

Underperformance triggers a documented escalation path: operational, management, then contractual remedies.

Supplier surveys and relationship health checks capture qualitative signals not visible in SLAs.

Continuous improvement: joint plans, innovation sharing, and lessons learned feed back into strategy and segmentation.

Measure both supplier performance and the organization's own performance as a customer (clear requirements, timely payments).