Supplier assurance · Run for you monthly
Supplier Assurance Office: supplier checking run for you every month
The supplier checking function run as a monthly service by a named lead: new suppliers checked before contracts are signed, renewals examined with missing clauses asked for, certificates re-verified at source, supplier incidents answered within days, and a register kept current with one page a month to whoever owns risk. From £3,500 + VAT per month, fixed by supplier count, with 30 days’ notice and a handover path to your own team designed in.
The office at a glance
Definition
What is a supplier assurance office?
A supplier assurance office is the supplier checking function of a company, run as a monthly service by a named external lead. It checks new suppliers before contracts are signed, redoes each supplier’s check on a schedule set by how much damage that supplier could do, re-verifies certificates when they expire and re-reads their scope when the service changes, asks for the missing contract clauses at every renewal, answers quickly when a supplier has an incident, and keeps a register that is always current, reported on one page a month to whoever owns risk.
It exists because supplier checking is the work that falls off an internal team’s desk whenever anything urgent lands, and because a portal licence collects answers without checking them. Intelance runs the office from £3,500 + VAT per month, fixed by supplier count, with 30 days’ notice and a handover path to your own team designed in from the start.
If you want the capability built in-house instead, the Supplier Assurance Framework builds it once from £14,500 + VAT. If the whole security function needs running rather than the supplier slice, vSCARO covers it from £7,500 + VAT per month, and the wider practice is described under cyber assurance.
Nothing signed unchecked
New suppliers tiered and checked before contracts.
Renewals used
Checks redone and clauses asked for while asking is free.
Incidents answered
Facts within days, with your exposure named.
One page a month
The register current and the board question answered.
The monthly work
What the office does month after month
Six jobs on a schedule, each leaving evidence behind it. Every card says what lands each month.
The front door
Every new supplier tiered and checked before the contract is signed, while you still have the leverage to ask for anything.
Monthly resultNothing gets signed unchecked, however busy your team is.Renewal checks
Each renewal triggers the check being redone and the missing contract clauses being asked for, at the moment asking is free.
Monthly resultContract gaps close at renewal instead of surviving another term.Certificate re-verification
Expiry dates caught before they pass, certificates verified at source again, and scopes re-read when the service you buy changes.
Monthly resultNo expired certificate sitting in the folder as evidence.Supplier incidents
When a supplier has a breach, the office answers within days: what happened, what it touched of yours, whether they met their duties, whether to stay.
Monthly resultTheir bad week does not become your bad quarter.The chasing
Suppliers who ignore requests get chased professionally and persistently, and a refusal to show evidence is recorded as a finding.
Monthly resultThe silence that stalls internal teams becomes an answer either way.The register and the page
Every supplier, its tier, its last check and its next one, kept current in your own tools, with one page a month to whoever owns risk.
Monthly resultThe board question answered from a current register.How it works
How the office runs from take-on to exit
A published rhythm from the first month, an incident duty when it matters, and an exit you choose.
Take-on
Your supplier list adopted or built, tiers set, the renewal calendar loaded, and the backlog of unchecked suppliers priced in the open rather than discovered later.
The rhythm
The front door, the renewals, the certificates, the chasing, the register and the one page report, on schedule.
The re-cut
Tiers re-checked against what each supplier now holds and reaches, the year’s trend reported, and the riskiest suppliers named plainly.
The supplier incident
The office drops into incident mode: facts within days, your exposure named, notice duties checked, and a stay or go recommendation.
The exit
Hand the function to your own team with the framework and training to keep it running, widen to the full security office, or stop with 30 days’ notice. The exit is designed in from the start.
Larger supplier bases carry a larger office, and we say how much at take-on. Deep single-vendor reviews are scoped separately when a case demands one, through the Supplier Assurance Review.
Published fees
The services around the office
Each route is priced before you choose it, and each stands alone.
Supplier Assurance Review
One supplier checked deeply: certificates verified at source, claims tested against evidence, the contract read, a written verdict.Best whenOne name needs a deep look now. FeeFrom £4,500 + VAT / supplier 02Supplier AI & Cyber Risk Assessment
All your critical suppliers checked and ranked by what they could break, in ten working days.Best whenThe office should start from a measured baseline. FeeFrom £8,500 + VAT10 working days 03
Supplier Assurance Framework
The capability built into your own team: tiering rules, question sets, evidence standards, a register and training.Best whenYou want the checking run in-house. FeeFrom £14,500 + VAT 04Virtual Security Office (vSCARO)
The whole security function run monthly, with supplier assurance one part of it.Best whenThe gap is wider than suppliers. FeeFrom £7,500 + VAT / monthThe alternatives
How the office compares with the alternatives
Three ways companies handle the supplier checking workload. The difference is whether the checks happen.
Good people asked to check suppliers on top of their actual jobs
The checks happen in January, then never again
Urgent work always wins, and supplier checking is never urgent until it is
Free, until it fails
Software that sends questionnaires and stores whatever comes back
The folder fills, nobody reads it, the licence renews
A tool cannot read a certificate scope or chase a supplier who ignores it
A licence, forever
A named lead doing the supplier work every month: checking, chasing, reading and reporting, from £3,500 + VAT per month
New suppliers checked before signing, renewals examined, incidents answered, one page a month
The office runs the work. The risk decisions stay yours, which is what the monthly page is for
Running from month two, from £3,500 + VAT per month
Scope
Inside the scope and outside it
You get
A named lead running the supplier checking function every month.
New suppliers checked before signing, renewals examined and certificates re-verified at source.
Supplier incidents answered within days, with your exposure named and their duties checked.
A register kept current in your own tools, with one page a month to whoever owns risk.
A fixed monthly fee by supplier count, 30 days’ notice and a handover path designed in.
This is not
A portal. Nothing is licensed. The register lives in your tools, and the checking is done by people who read scopes and contracts.
A transfer of accountability. The office runs the work. The risk decisions stay yours, informed by the monthly page.
A lock-in. Thirty days’ notice, and handover to your own team is a designed exit with the framework and training to keep it running.
Incident response for your own estate. The office answers supplier incidents. A breach of your own systems is a different engagement.
Where to start
Where this usually starts
Four situations we are usually called into. If none of them fit, speak to us and we will point you at the right first step.
Why Intelance
The rules we work to
A named lead every month
The person who checks, chases and reports is named before the retainer starts and answers to you.
Fixed by supplier count
From £3,500 + VAT per month, in writing. The backlog of unchecked suppliers is priced in the open at take-on.
Evidence chased to an answer
Certificates verified at source, scopes re-read when services change, and refusals recorded as findings. Nothing is filed unread.
We sell advice and nothing else
No portal, no licences, no vendor commission. The register lives in your own tools.
An exit designed in
Hand over to your team, widen to vSCARO, or stop with 30 days’ notice. A service that fights to stay is a bad one.
Who runs the work
The Supplier Assurance Office is led by a senior security lead, supported by senior consultants and established delivery partners.
Supplier assurance guides
All insights
Cyber EssentialsCyber Essentials vs ISO 27001 vs IASME Cyber Assurance: which do you need?
The three UK security certifications compared, including the one most guides skip: what each covers, what each costs, and the ladder order that means no money is wasted, from a certification body that holds two of them itself.
9 July 2026 · 6 min read Read the guide
Cyber EssentialsCyber Essentials vs ISO 27001: when you need one, both, and in what order
23 March 2026 · 10 min read
CybersecurityISO 27001 readiness assessment checklist (UK)
8 December 2025 · 11 min read
AI GovernanceEU AI Act ISO 42001: how they fit together in your architecture
7 December 2025 · 10 min readReady to talk?
Tell us who checks your suppliers today
Thirty minutes with the lead who would run it: how many suppliers you have, who checks them now and what happens at renewals. If the honest answer is that the checks happened once and then stopped, that is the most common take-on we see.
FAQs
Questions about the office
What is a supplier assurance office?
The supplier checking function of a company, run as a monthly service by a named external lead: new suppliers checked before contracts are signed, renewals examined, certificates re-verified at source, supplier incidents answered within days, and a register kept current with one page a month to whoever owns risk.
How much does a managed supplier risk service cost?
From £3,500 + VAT per month with Intelance, fixed in writing by supplier count, with 30 days’ notice. The backlog of unchecked suppliers is priced in the open at take-on. For context, supplier risk portals carry annual licences that typically run from $20,000 to well over $100,000 a year and still leave the reading and chasing to you.
Can supplier risk management be outsourced without a portal?
Yes, and it usually works better. The register lives in your own tools, and the work is done by people who can read a certificate scope against the service you buy, read a contract for breach notice and exit terms, and chase a supplier who ignores requests. A portal can do none of those things.
What happens when a supplier has a data breach?
The office drops into incident mode and answers within days: what happened, what it touched of yours, whether the supplier met its contractual and legal duties, and whether to stay or go. Where the case demands a forensic single-vendor examination, a Supplier Assurance Review is scoped separately.
Should supplier checking be run in-house or as a service?
In-house, if your team has the capacity: the Supplier Assurance Framework builds that capability once, from £14,500 + VAT. As a service, when supplier checking keeps falling off the desk, which is the most common reality. The office is designed to hand over to your team whenever you are ready, so choosing the service first closes no doors.
What is the difference between the Supplier Assurance Office and vSCARO?
Scope. The office runs the supplier slice of security: checking, renewals, certificates, incidents and the register. vSCARO runs the whole security function monthly, with supplier assurance one part of it, from £7,500 + VAT per month. Firms often start with the office and widen later.
What is the difference between the office and the framework?
The framework is built once and run by your own team. The office is the same function run for you, month after month. They connect: when the office hands over, your team inherits the framework, the register and the training to keep it running.
How does the service end?
Three ways, all designed in from the start: handover to your own team with the framework and training to keep it running, widening to vSCARO when the whole security function needs an owner, or simply stopping with 30 days’ notice. Every artefact, register and report is yours either way.