Supplier assurance · Fixed fee per supplier
Supplier Assurance Review: an independent check of a single supplier
An independent check of a single supplier in five to ten working days: certificates verified at source and scopes read against the service you buy, security claims tested against evidence, the contract read for breach notice and exit terms, AI features examined and access reviewed. The verdict arrives in writing: proceed, proceed with fixes, or walk away. From £4,500 + VAT per supplier, fixed before work starts.
The review at a glance
Definition
What is a supplier assurance review?
A supplier assurance review is an independent check of a single supplier, run before a contract is signed, at renewal or after an incident. It verifies the supplier’s certificates at source and reads their scope against the service bought, tests security answers against evidence rather than accepting a questionnaire, reads the contract for breach notice, liability, audit rights, exit terms and where data lives, examines any AI features and where data goes when they are used, and reviews what access the supplier holds into your systems. The result is a clear verdict in writing with a fix list, defensible to whoever asked the question.
Intelance delivers the review in five to ten working days from £4,500 + VAT per supplier, fixed before work starts, with shortlists priced per supplier. The principle is simple: we read what they sent you, then we check it. A vendor security assessment that stops at the questionnaire has assessed the supplier’s optimism rather than their security.
If the question covers the whole list rather than one name, the Supplier AI & Cyber Risk Assessment checks and ranks every critical supplier in ten working days. If checking should happen every month, vSCARO runs it as a standing function, and the wider practice is described under cyber assurance.
Verified at source
Certificates checked with the issuer, scope read line by line.
We verify rather than collect
Claims tested against settings, reports and records.
The contract
Breach notice, liability, audit rights, exit and data location.
A verdict in writing
Proceed, proceed with fixes, or walk away, with the evidence.
The six checks
Six things we check that a questionnaire never will
Questionnaires collect the supplier’s own answers about themselves. The review checks the things those answers rest on, and each card says what we usually find when we do.
The certificate and its scope
Verified at source rather than taken from a logo on their website, and the scope read line by line against the service you buy.
What we usually findThe certificate covers one office, and your service runs somewhere else.The security claims
Every security answer they gave you checked against evidence: settings, reports and records rather than promises.
What we usually findThe questionnaire said yes. The evidence says partly.The contract terms
Breach notice periods, liability caps, audit rights, exit terms and where your data lives, read by people who know what missing clauses cost.
What we usually findNo duty to tell you about a breach quickly, or at all.The AI they switched on
Features added quietly to tools you already use: what they do, where your data goes, and whether anyone agreed to it.
What we usually findYour data training someone’s model under a terms update nobody read.The access they hold
What this supplier can reach in your systems, how it is controlled, and what happens to it when the contract ends.
What we usually findAccess that outlived the project it was granted for.The written verdict
A clear answer: proceed, proceed with fixes, or walk away, with the evidence behind it and a fix list the supplier can act on.
You getAn answer you can show the customer, insurer or regulator who asked.How it works
What happens in the five to ten working days
One evidence request, everything checked at source, a documented supplier call, and a verdict you can act on. The process is fair to the supplier, which is why the verdict holds.
Scope and request
What you buy from them, what they hold and what they can reach, agreed with you. Then one clear evidence request to the supplier instead of a forty page form.
Everything checked
Certificates verified at source, scopes read against your service, claims tested against evidence, the posture checked from outside, the contract read.
The supplier call
Gaps put to the supplier directly and professionally: their chance to show evidence we have not seen, and to prove us wrong. Fair, documented, and often where the truth appears.
Verdict and report
Proceed, proceed with fixes, or walk away, with the evidence behind it, a fix list, and the contract changes worth asking for.
Acting on it
You negotiate from the findings, fix the contract at renewal, or walk away before signing. If you want the whole list done, that is a separate, priced job. You are never tied to us.
Larger or slower suppliers take longer, and we say which at scoping. A supplier that refuses to provide evidence has answered the question: the refusal goes in the report as a finding, with what it means for your decision.
Published fees
When you need more than one supplier checked
The review is the single-supplier answer. When the question is bigger, each route is priced before you choose it.
Supplier AI & Cyber Risk Assessment
All your critical suppliers checked and ranked by what they could break, in ten working days.Best whenThe whole list needs the answer rather than one name. FeeFrom £8,500 + VAT10 working days 02
Supplier Assurance Framework
The capability built in your own team: tiering, templates, evidence standards and the running rhythm, bought once.Best whenSupplier checking should live in-house. FeeFrom £14,500 + VAT 03Virtual Security Office (vSCARO)
A monthly service that keeps supplier checks, certificates and evidence current all year.Best whenSupplier assurance needs to be standing, and someone has to own it. FeeFrom £7,500 + VAT / month 04OT / IT Cyber Readiness
When suppliers hold remote access to factories and warehouses, the whole operation deserves the deeper check.Best whenThe supplier can reach production systems. FeeFrom £16,500 + VATThe alternatives
How the review compares with the alternatives
Three ways organisations answer the supplier question. The difference is whose word you end up relying on.
The supplier fills in a form about themselves, optimistically, once a year
A folder of answers nobody reads, refreshed annually
The answers are written by the people being assessed
Weeks of chasing, nothing learned
A logo on their website stands in for evidence, and nobody reads the scope
False comfort, filed as evidence, until their incident becomes yours
The certificate may cover one office while your service runs somewhere else
Instant, and it proves very little
Everything they sent you, read and then checked: certificates, claims, contract and AI use, from £4,500 + VAT per supplier
A verdict in writing, the gaps named, a fix list, and evidence you can show whoever asked
It checks one supplier properly. A long list needs the shortlist assessment first
5 to 10 working days, from £4,500 + VAT per supplier
Scope
Inside the scope and outside it
You get
Certificates verified at source, with the scope read against the service you buy.
Every security claim tested against evidence: settings, reports and records.
The contract read for breach notice, liability, audit rights, exit terms and data location.
AI features and supplier access examined, with what they can reach written down.
A verdict in writing: proceed, proceed with fixes, or walk away, with a fix list the supplier can act on.
This is not
A questionnaire service. The supplier’s answers are where we start rather than where we stop.
A penetration test. We check the posture from outside and the evidence at source. We do not attack their systems. Where a technical test is warranted, the report says so.
A rubber stamp. Proceed with fixes and walk away are real outcomes, and a refusal to provide evidence is itself a finding.
A subscription by stealth. The verdict stands on its own. The whole list, the framework and the monthly function are separate, priced choices, and you are never tied to us.
Where to start
Where this usually starts
Four situations we are usually called into. If none of them fit, speak to us and we will point you at the right first step.
Why Intelance
The rules we work to
We read the evidence, then we verify it
We read what they sent you, then we check it: certificates at source, claims against evidence, the contract line by line.
Fixed fee per supplier
From £4,500 + VAT, fixed before work starts. Shortlists are priced per supplier, in writing, before anyone begins.
Refusals become findings
A supplier that will not show evidence has answered the question. It goes in the report, with what it means for your decision.
Fair to the supplier
Gaps are put to them directly on a documented call, with the chance to prove us wrong. Verdicts hold because the process is fair.
We sell advice and nothing else
No platform, no per-seat licence, and no stake in whether the supplier proceeds or fails. The verdict has no commercial thumb on the scale.
Who runs the work
Every review is run by a senior security lead, supported by senior consultants and established delivery partners.
Supplier assurance guides
All insights
Cyber EssentialsCyber Essentials vs ISO 27001 vs IASME Cyber Assurance: which do you need?
The three UK security certifications compared, including the one most guides skip: what each covers, what each costs, and the ladder order that means no money is wasted, from a certification body that holds two of them itself.
9 July 2026 · 6 min read Read the guide
Cyber EssentialsCyber Essentials vs ISO 27001: when you need one, both, and in what order
23 March 2026 · 10 min read
CybersecurityISO 27001 readiness assessment checklist (UK)
8 December 2025 · 11 min read
AI GovernanceEU AI Act ISO 42001: how they fit together in your architecture
7 December 2025 · 10 min readReady to talk?
Tell us which supplier and why now
Thirty minutes with the person who would run your review: what the supplier holds, what they can reach and what raised the question. If the trigger is a contract about to be signed, say so, and we will move quickly.
FAQs
Questions about the supplier review
What is a supplier assurance review?
An independent check of a single supplier, run before signature, at renewal or after an incident: certificates verified at source, scope read against the service bought, claims tested against evidence, the contract read, AI features and access examined. It ends in a written verdict, proceed, proceed with fixes, or walk away, with a fix list and the evidence behind it.
How much does a supplier assurance review cost?
From £4,500 + VAT per supplier with Intelance, fixed before work starts, delivered in five to ten working days. Shortlists are priced per supplier in writing. For context, third party risk platforms typically run from $20,000 to well over $100,000 a year and still rest on questionnaires the supplier fills in about themselves.
Why is a supplier questionnaire not enough?
Because the answers are written by the people being assessed. Questionnaires measure optimism and paperwork discipline rather than security. The review starts from their answers and checks them: at source, against evidence, in the contract, on a documented call.
Is a supplier’s ISO 27001 certificate enough evidence?
Not by itself. A certificate can be expired, unaccredited or genuine but scoped to one office while your service runs somewhere else entirely. The review verifies the certificate at source, checks the certification body, and reads the scope statement line by line against the service you buy. That last step is where most surprises live.
What is the difference between a supplier assurance review and a third party risk assessment?
Depth against breadth. A third party risk assessment usually means a portfolio process: tiering the supplier base and applying proportionate checks across it, which is what our Supplier AI & Cyber Risk Assessment and Framework cover. The review is the deep, single-supplier instrument those processes escalate to when one name matters.
When should a supplier be reviewed?
At the moments the leverage changes: before a contract is signed, when the leverage is highest. At renewal, when terms can be fixed. After an incident, theirs or yours. After a quiet AI terms update, when your data may have started training someone’s model. If a customer, insurer or regulator is asking, the review produces the evidence they want to see.
What if the supplier refuses to cooperate?
The review continues. Certificates are verified at source, posture is checked from outside and the contract is read without their help. The documented call gives them every chance to show evidence, and a refusal to provide it is itself a finding: it goes in the report with what it means for your decision.
What happens after the verdict?
You act on it: negotiate from the findings, fix the contract at renewal, or walk away before signing. If the question grows, the shortlist assessment covers the list from £8,500 + VAT, the Framework builds the capability in-house from £14,500 + VAT, and vSCARO runs it monthly from £7,500 + VAT. Each stands alone, and you are never tied to us.