Cyber Resilience & Supplier Assurance
18+ yearsSenior practitioner experience
Published supplier-audit evidenceNationwide supplier audit for AIG
Global audit deliveryInternational assurance and audit experience
ISO/IEC 27001:2022Certified information-security management
Ongoing independent supplier assurance that turns third-party evidence into risk decisions, remediation and continuing oversight.
Suited to organisations whose suppliers hold sensitive data, run critical services or face customer and regulatory scrutiny.
One-off supplier due diligence is a point-in-time assessment of a supplier, usually before contract. It answers whether a supplier looked acceptable on the day it was assessed.
Managed Supplier Assurance keeps that answer current. IG-Smart governs the assurance process, helps set risk-based requirements, reviews and challenges evidence, identifies findings, tracks remediation, supports exception governance, reassesses where agreed and reports the assurance position.
The client selects suppliers, owns commercial decisions, accepts or rejects risk, approves exceptions, determines contractual action and decides whether supplier relationships are retained, restricted or ended.
The questions it answers
IG-Smart provides governance, assessment, challenge and assurance. Selecting suppliers, contracting, accepting operational risk and deciding whether to continue a relationship remain management decisions.
When organisations engage us
What the service covers
How we deliver
Assess
Baseline the supplier inventory, tiering and current assurance coverage.
Build
Agree tiering criteria, evidence requirements, owners and reporting.
Manage
Run assessment, challenge, remediation tracking and exceptions month to month.
Assure
Report coverage and exposure; escalate critical supplier concerns.
Improve
Adjust tiering and reassessment as suppliers, incidents and regulation change.
Scope boundaries
Sample outputs
Representative reports, registers and records, so you can picture the output before you engage.
Illustrative structure — not a client document. Examples show the type, format and level of detail clients may receive. Exact outputs depend on the agreed scope.
Illustrative output
A living view of every in-scope supplier: risk tier, domains assessed, assurance position, owner, outstanding actions and next review. Not every supplier is assessed against every domain.
Likely format
The structure, format and level of detail depend on the agreed scope. This is not a client document.
Illustrative output
Supplier assertion, evidence received and reviewed, challenge raised and the resulting assurance position.
Likely format
The structure, format and level of detail depend on the agreed scope. This is not a client document.
Illustrative output
Findings, actions, owners, due dates, closure evidence and accepted exceptions.
Likely format
The structure, format and level of detail depend on the agreed scope. This is not a client document.
Illustrative output
Executive view of assurance coverage, material third-party exposure, unresolved issues, trends and decisions required.
Likely format
The structure, format and level of detail depend on the agreed scope. This is not a client document.
Relevant evidence
The named client has approved reference to the third-party supplier relationship; the supplier remains unnamed. The description does not extend the engagement beyond its approved record.
Named client · Financial Services
Supplier data-governance audit
Nationwide supplier audit
Evidence relevance
Featured supplier-assurance evidence
AIG
AIG — third-party supplier assurance within a wider governance and assurance programme: a nationwide, defined-scope audit of an external records-storage supplier, covering governance, physical and security controls, records lifecycle, resilience and related risk. The supplier remains unnamed, and remediation remained its responsibility.
View case studyYour IG-Smart team
Subject-matter expertise is paired with a clear client and programme contact from initial scoping through delivery.
Subject-matter expert
CEO and Founder
Governance, risk and assurance specialist with more than 18 years' experience spanning privacy, cyber resilience, AI governance, digital transformation, healthcare and complex regulated organisations.
Experience includes governance and assurance work involving more than 100 million consumer records.
View profile
Subject-matter expert
Senior Cyber Security Consultant
Cybersecurity specialist with 10+ years' experience and founder of Africahackon, combining security engineering and technical assurance with expertise in cyber governance, resilience, vulnerability management and organisational risk.
View profile
Client & programme contact
Head of Client & Programme Success
A key point of contact from prospective-client scoping through programme and project delivery, coordinating practitioners, workstreams and client stakeholders.
View profileRelated needs
Suppliers handling personal data across borders?
International Data Transfer Assurance: talk to a Senior PractitionerNeed continuing cyber leadership, not only supplier review?
Cyber Resilience & Supplier AssuranceSuppliers processing personal data on your behalf?
Managed Data Privacy ProgrammeSuppliers providing AI or automated decision-making?
AI Governance & AssuranceNeed the supplier-risk position in front of the Board?
Governance Assurance & Board Reporting: talk to a Senior PractitionerInvestment
More complex managed supplier-assurance programmes are scoped according to supplier population, criticality, assessment depth, reassessment frequency, remediation workload and reporting requirements. Scope, deliverables, assumptions and fees are agreed in writing before work begins.
Talk to a Senior Practitioner How engagements & investment work
Questions
No. Questionnaires are one input. The service prioritises suppliers by risk, challenges the evidence behind answers, tracks remediation and exceptions, and reports the position so decisions can be made.
You do. IG-Smart provides assessment, challenge and assurance. Appointing suppliers, contracting, accepting operational risk and continuing or ending a relationship remain management decisions.
No. Scope is risk-based: each supplier is assessed only against the domains relevant to the data it holds, the service it provides and the regulation that applies.
Yes. The service is designed to fit your existing intake, contracting and risk registers rather than replace them.
Next step