Supplier assurance · Built once, owned by you
Supplier Assurance Framework: supplier checking built into your own team
The standing way your company checks suppliers, built in four to six weeks and owned by you: tiering rules so each supplier gets a proportionate check, question sets with evidence standards, a contract clause list for every renewal, a front door in your buying process, and a register in your own tools. Piloted with your team on three of your real suppliers before handover. From £14,500 + VAT, fixed before work starts.
The framework at a glance
Definition
What is a supplier assurance framework?
A supplier assurance framework is the standing way a company checks its suppliers, built once and run by its own team. It sets the rules for which suppliers get which depth of check, so a stationery supplier is not asked the same two hundred questions as the firm holding all your customer data. It defines the questions to ask and the evidence that counts, including reading a certificate’s scope against the service bought. It gives buyers a contract clause list for every signing and renewal, covering breach notice, audit rights, exit terms and data location. And it lives in your own tools as a register and renewal calendar rather than in a portal with an annual licence.
Intelance builds the framework in four to six weeks from £14,500 + VAT, fixed before work starts, and proves it by piloting it with your team on three of your real suppliers before handover. The timing matters: UK rules are widening duties around suppliers, and insurers and enterprise customers increasingly ask to see a working process with evidence rather than a policy.
If nobody in-house has the time yet, the Supplier Assurance Office runs the framework for you from £3,500 + VAT per month and hands it over when you are ready. If one supplier needs a deep look now, the Supplier Assurance Review covers a single name, and the wider practice is described under cyber assurance.
Proportionate checks
Tiering decided by what each supplier could break.
Evidence that counts
Certificates verified at source, scopes read against the service.
Leverage kept
Clauses asked for at signing and at every renewal.
Your own tools
A register and renewal calendar, with no licence attached.
The six parts
The six parts of a framework your team will use
Each part exists because supplier checking fails without it. Every card says why it matters in practice.
The tiering rules
Which suppliers get which depth of check, decided by what each one could break: the data they hold, the access they have, what stops if they fail.
Why it mattersThe stationery supplier stops getting the two hundred question form.The questions and the evidence
What to ask each tier, and what proof counts: certificates verified at source, scopes read against the service bought, claims backed by evidence.
Why it mattersYour team stops filing answers and starts checking them.The contract clause list
Breach notice, audit rights, exit terms and data location, written as clauses your buyers ask for at every signing and every renewal.
Why it mattersContract gaps get fixed for free at renewal, or never.The front door
New suppliers checked before the contract is signed, built into your buying process so nothing gets bought around it.
Why it mattersLeverage exists before signature and disappears after.The register and the calendar
Every supplier, its tier, its last check and its renewal date, kept in your own tools with reminders that fire.
Why it mattersNo portal and no licence: nothing renews except the checks themselves.A trained team
The pilot runs the framework on three of your real suppliers, with your people doing the work and us coaching alongside.
Why it mattersCapability that stays when we leave is the whole point.How it works
The four to six weeks in order
Built with your team rather than delivered to them, and proven in a pilot before we leave.
What you buy and from whom
Your supplier list, spend and contracts gathered, current checking practice reviewed honestly, and the risk picture agreed. Most firms find suppliers nobody remembers signing.
The framework built
Tiering rules, question sets, evidence standards and the contract clause list, drafted with the people who will use them.
The pilot
Three real suppliers checked by your team using the framework, with us coaching. Whatever jams gets fixed during the pilot. The pilot is the acceptance test.
Wired in and handed over
The front door built into your buying process, the register and renewal calendar set up in your own tools, and the team signed off.
Yours to run
Your team runs it from here. If you would rather it were run for you, the Supplier Assurance Office does that as a separate priced service. You are never tied to us.
Larger supplier bases take longer, and we say how much at scoping. If you want evidence about your current suppliers first, the Supplier AI & Cyber Risk Assessment produces it in ten working days and feeds the tiering directly.
Published fees
The services around the framework
Each route is priced before you choose it, and each stands alone.
Supplier Assurance Review
One supplier checked deeply: certificates verified at source, claims tested against evidence, the contract read, a written verdict.Best whenOne name matters more than the process. FeeFrom £4,500 + VAT / supplier 02Supplier AI & Cyber Risk Assessment
All your critical suppliers checked and ranked by what they could break, in ten working days.Best whenYou want the risk picture before designing the framework. FeeFrom £8,500 + VAT10 working days 03
Supplier Assurance Office
The framework run for you monthly: new suppliers checked before signing, renewals examined, one page a month to the board.Best whenNobody in-house has the time yet. FeeFrom £3,500 + VAT / month 04Virtual Security Office (vSCARO)
The wider security function run monthly, with supplier assurance one part of it.Best whenSuppliers are one piece of a bigger security gap. FeeFrom £7,500 + VAT / monthThe alternatives
How the framework compares with the alternatives
Three ways companies handle supplier checking. The difference is what your own team can do next year.
A software licence with questionnaires inside, renewed every year
Suppliers ignore portal requests, and the folder fills with unread answers
The tool cannot read a certificate scope or a contract
A licence, forever
Good answers that leave the building when the consultants do
Every new supplier question becomes a new invoice
The capability never lands in your own team
An invoice, every time
The way your company checks suppliers, built once, owned by you and run by your team, from £14,500 + VAT
Tiering rules, question sets, evidence standards and contract clauses, piloted on three real suppliers
Your team has to own it. Where nobody has the time, the Supplier Assurance Office runs it instead
4 to 6 weeks from £14,500 + VAT, then it is yours
Scope
Inside the scope and outside it
You get
Tiering rules that give each supplier a proportionate check, decided by what it could break.
Question sets per tier with evidence standards, including certificate verification at source.
A contract clause list your buyers use at every signing and renewal.
A front door in your buying process, plus the register and renewal calendar in your own tools.
A team trained through a pilot on three of your real suppliers, signed off before handover.
This is not
A portal or platform. Nothing is licensed, and nothing renews except the checks themselves.
A policy document. Every part is built to be used: rules, questions, clauses, the register and the calendar.
A dependency. The pilot proves your team can run it before we leave, and the framework is yours.
The checks themselves. Deep single-supplier reviews and the full supplier risk assessment are separate, priced services.
Where to start
Where this usually starts
Four situations we are usually called into. If none of them fit, speak to us and we will point you at the right first step.
Why Intelance
The rules we work to
Built by practitioners
The people who design your framework run supplier checks for a living, so the question sets ask for evidence a supplier can provide.
A fixed fee agreed in writing
From £14,500 + VAT, fixed before work starts. Larger supplier bases take longer, and we say how much at scoping.
Proven in a pilot
Your team checks three real suppliers before handover. Whatever jams gets fixed while we are still there.
We sell advice and nothing else
No portal, no licence, no vendor commission. The framework lives in your own tools.
Designed for your team to run
The engagement ends with your team running the framework. Where you want it run for you, that is a separate priced choice, never a default.
Who runs the work
Every framework build is led by a senior security lead, supported by senior consultants and established delivery partners.
Supplier assurance guides
All insights
Cyber EssentialsCyber Essentials vs ISO 27001 vs IASME Cyber Assurance: which do you need?
The three UK security certifications compared, including the one most guides skip: what each covers, what each costs, and the ladder order that means no money is wasted, from a certification body that holds two of them itself.
9 July 2026 · 6 min read Read the guide
Cyber EssentialsCyber Essentials vs ISO 27001: when you need one, both, and in what order
23 March 2026 · 10 min read
CybersecurityISO 27001 readiness assessment checklist (UK)
8 December 2025 · 11 min read
AI GovernanceEU AI Act ISO 42001: how they fit together in your architecture
7 December 2025 · 10 min readReady to talk?
Tell us about your suppliers
Thirty minutes with the person who would build it: how many suppliers you have, who checks them today and what triggered the question. If a customer or insurer has asked to see your process, the framework is the answer they expect to find.
FAQs
Questions about the framework build
What is a supplier assurance framework?
The standing way a company checks its suppliers, built once and run by its own team: tiering rules that decide which suppliers get which depth of check, question sets with evidence standards, a contract clause list for signings and renewals, a front door in the buying process, and a register with a renewal calendar kept in your own tools.
How much does a supplier assurance framework cost?
From £14,500 + VAT with Intelance, fixed before work starts, built in four to six weeks and piloted with your team on three real suppliers before handover. For context, supplier risk portals carry annual licences that typically run from $20,000 to well over $100,000 a year, and consultancy-run checking produces a new invoice for every supplier question.
What is the difference between a supplier assurance framework and a third party risk management framework?
They are the same thing under different labels. Vendor risk framework is a third. What matters is the content: proportionate tiers, questions backed by evidence standards, contract clauses your buyers use, and a register your own team runs. A framework that lives in a binder under any name is not a framework.
Is a supplier risk portal better than a framework?
For most UK firms with tens to hundreds of suppliers, no. Portals licence questionnaires: they collect answers but cannot read a certificate scope against the service you buy or a contract against your exit needs. A portal suits firms with thousands of suppliers and a team dedicated to feeding it. The framework puts the judgement in your own team, without a licence.
What does proportionate supplier checking mean?
The depth of check matches what the supplier could break: the data they hold, the access they have and what stops if they fail. Critical suppliers get evidence-backed scrutiny. Low-risk suppliers get a short check that takes minutes. Proportionality is what makes a framework sustainable for the team running it.
Should we assess our suppliers before building a framework?
Often, yes. The Supplier AI & Cyber Risk Assessment checks and ranks your critical suppliers in ten working days from £8,500 + VAT, and the results feed the tiering rules directly, so the framework starts from evidence rather than assumptions.
Who runs the framework after handover?
Your team, trained through the pilot: three real suppliers are checked by your people with us coaching, and handover happens when the team is signed off. Where nobody has the time yet, the Supplier Assurance Office runs the framework for you from £3,500 + VAT per month and hands it over when you are ready.
Why are customers and insurers asking about supplier assurance?
Because supply chains are where incidents increasingly start, UK rules are widening duties around suppliers, and a policy on file proves nothing. What satisfies an insurer or an enterprise customer is a working process: a tiered register with dates, evidence standards, and checks that demonstrably ran. That is exactly what the framework produces.