Third-party and supply-chain risk is the exposure to financial loss, non-delivery and statutory non-compliance that external suppliers and contractors bring to an institution.
Because the consequences land on the institution, not the supplier, overseeing that risk is a leadership duty, not a procurement afterthought.
What third-party and supply-chain risk is
Third-party and supply-chain risk covers the operational, financial and legal exposure that suppliers, contractors and service providers introduce. It shows up when a contractor fails to deliver, provides substandard goods or services, breaches the procurement rules, acts fraudulently, or leaves the institution over-reliant on a single vendor. Because public institutions lean heavily on external contractors to run capital projects, supply essential goods and provide specialist services, a third-party failure strikes directly at institutional objectives — and, under the PFMA as administered by National Treasury, it translates into unauthorised, irregular, or fruitless and wasteful expenditure, financial loss, and disrupted service delivery.
Why it is the institution's risk to own
Leaders, boards and risk officers must be clear that this risk belongs to the institution, not the contractor. Under Chapter 5 of the PFMA, the duty to operate financial-management systems, enforce internal controls, prevent overspending and prevent non-compliant expenditure rests squarely on the accounting officer, and Third-party and supply-chain risk: an institutional oversight agenda is non-delegable. An organ of state can contract out the execution of a service, but it cannot transfer its statutory accountability or legal liability to a third party. When a contractor fails, defrauds or breaches the procurement law, the institution carries the legal, financial and reputational consequences — and an accounting officer who fails to oversee third parties adequately risks statutory sanction for negligence.
The oversight agenda at award
Managing third-party risk begins before the contract is signed, in rigorous screening at sourcing and evaluation. Public procurement rests on Section 217 of the Constitution — fair, equitable, transparent, competitive and cost-effective — which the Preferential Procurement Policy Framework Act 5 of 2000 operationalises. Under that Act, an acceptable tender complies in all respects with the specifications and conditions of the tender document; tenders are evaluated on the preference-point system that balances price against the specified goals; the contract goes to the highest total points scorer unless objective criteria justify otherwise; and the organ of state may cancel a contract awarded on false information furnished to secure preference.
Enforcing strict evaluation at award screens out unqualified, non-responsive or deceptive suppliers before any public money is committed.
Under Chapter 5 of the PFMA, the duty to operate financial-management systems, enforce internal controls, prevent overspending and prevent non-compliant expenditure rests squarely on the accounting officer, and Third-party and supply-chain risk: an institutional oversight agenda is non-delegable.
— Synthesis of South African regulatory guidance
The oversight agenda in delivery and payment
After award, oversight moves to delivery and disbursement. The Auditor-General South Africa (AGSA) control framework rests on proper record-keeping of all transactions and effective controls over the daily and monthly processing and reconciliation of transactions. The institution must verify, physically and on paper, that the goods or services were delivered in full and to specification before it authorises payment.
Disbursing without that verification is where third-party risk becomes fruitless and wasteful expenditure — and paying for goods or services never received is a material irregularity under the Public Audit Act. When the AGSA flags one, the accounting officer is notified and must act at once to stop the loss, recover the funds from the contractor and institute proceedings against responsible officials.
Continuous oversight and governance
Third-party risk needs continuous oversight across the contract lifecycle. Management and risk officers should monitor supplier performance against the agreed deliverables and watch supplier-concentration risk, so that no single vendor becomes a point of failure. Under Chapter 9 of the PFMA, the institution must maintain an adequately resourced internal audit unit and an active audit committee — internal audit should test third-party controls, contract files and payment reconciliations to find the gaps, while the audit committee evaluates the effectiveness of risk management, reviews those findings and makes sure management fixes third-party deficiencies before they become AGSA findings.
What good looks like
Good third-party oversight shows up as a sustained clean audit from the AGSA — financial statements free of material misstatement, reliable performance reporting and full compliance with the procurement legislation. It is an institution where accounting officers, boards and risk officers hold an unbroken oversight agenda across the whole contractor lifecycle, from pre-award screening through delivery verification to payment reconciliation — protecting public resources, eliminating material irregularities, and making sure state spending delivers real value.
Related insights
- Contract management: the controls connecting obligations, performance and payment
- Forensic investigation, forensic audit and forensic accounting: choosing the right mandate
- Probity audits: when independent procurement assurance is useful
Sources
- Public Finance Management Act: legislation overview — National Treasury
- Preferential Procurement Policy Framework Act 5 of 2000 — South African Government
- What we do: irregular expenditure, controls and material irregularities — Auditor-General South Africa
Frequently Asked Questions
What is third-party and supply-chain risk in the context of public institutions?
Third-party and supply-chain risk represents the exposure to financial loss, non-delivery, and statutory non-compliance that external suppliers and contractors introduce to an institution. This covers operational, financial, and legal exposures, which, under the PFMA, can translate into unauthorised, irregular, or fruitless and wasteful expenditure and disrupted service delivery.
To whom does the duty of overseeing third-party and supply-chain risk apply within public institutions?
The duty to oversee this risk rests squarely with the institution, not the contractor, making it a leadership responsibility. Specifically, under Chapter 5 of the PFMA, the accounting officer holds the non-delegable duty to operate financial management systems and prevent non-compliant expenditure. This means leaders, boards, and risk officers must actively own this oversight agenda.
Why is it critical for public institutions to own third-party and supply-chain risk?
It is critical because the consequences of third-party failures, such as financial loss or statutory non-compliance, ultimately land on the institution. An organ of state cannot transfer its statutory accountability or legal liability to a third party, even if it contracts out a service. An accounting officer who fails to adequately oversee third parties risks statutory sanction for negligence, as the institution carries the legal, financial, and reputational repercussions.
What does effective oversight of third-party risk look like in practice, and what are the consequences of failure?
Effective oversight results in a sustained clean audit from the Auditor-General South Africa (AGSA), demonstrating financial statements free of material misstatement and full compliance with procurement legislation. Conversely, failure leads to fruitless and wasteful expenditure, material irregularities flagged by the AGSA, and potential statutory sanctions for accounting officers. This signifies a breakdown in protecting public resources and ensuring state spending delivers real value.
Where do public institutions commonly falter in managing third-party and supply-chain risk?
Public institutions often falter by treating third-party oversight as a procurement afterthought rather than an ongoing leadership duty. Common pitfalls include insufficient rigorous screening of suppliers before contract award, disbursing payments without verifying delivery to specification, and inadequate continuous monitoring of supplier performance and concentration risk. A lack of robust internal audit testing of third-party controls also contributes to these deficiencies.