Third-Party Risk Management for Tier-One Contractors
Third-party risk management built for construction supply chains, where your sub-contractors' labour practices become your liability. We score your third-party risk across 4 areas and give you a ranked, prioritised plan to fix it.
Proven with a tier-one contractor
Built on a Live Tier-One Pilot
Our review runs on the TierOne risk capability maturity model, built with our team for construction supply chains. In 2021 the Multiplex pilot tested it against one of Multiplex's biggest sub-contractors.
Our construction, safety and labour experts advised on the greatest areas of risk: quality, reputation, workers' status and conditions, and data protection. Our CEO, Gavin Coyle, explains why the industry needs this approach.
“We need to adapt a maturity model in this area which has meaningful data that can be actioned and monitored. We are delighted that Multiplex have seen our vision and have decided to move forward with our team.”
Read the full model launch story for the background to the pilot.
The visibility gap
Where Construction Supply-Chain Risk Hides
Your CDM duties already make you answerable for who works on your sites. Third-party risk stretches that accountability across every contract you let.
- Contractors sub-contract further, so you rarely know the status of every worker on your project.
- You stay legally accountable for people you never hired, vetted or paid directly.
- Supplier questionnaires check the paperwork once at onboarding, then nobody looks again.
- Procurement, finance and compliance each hold part of the picture, and nobody owns the whole.
Each of these gaps is measurable. Once you can see them, you can rank them and fix the biggest first.
4 areas, 1 view of your risk
What Our Third-Party Risk Management Review Covers
We assess your third-party landscape across the 4 areas of the maturity model. Together they show how risk enters your supply chain and where your controls stop.
Leadership and governance
See whether your board and senior team own third-party risk, set clear standards for it, and sign off on the evidence behind your statement.
Third party risk management
Find out how well you identify, assess and monitor the contractors and sub-contractors you rely on, from onboarding through to project close.
Procurement
Test whether your supplier selection and contract terms screen out risk before a sub-contractor ever reaches site.
Payments and processing
Check how money flows down your supply chain, because payment practices often show where workers' conditions fall short.
How the review runs
How a Third-Party Risk Assessment Runs
We assess what happens on your projects as well as what sits in your files. Where you need checks on the ground, our site audits test your controls on live projects.
Scope your supply chain
We agree which projects and contractors the review covers, and who in your business holds each piece of the picture.
Assess the 4 areas
We test each of the 4 areas against the maturity model, looking hardest at the risks that hit tier-one contractors first.
Rank your maturity
You receive a maturity ranking for each area, so you can see exactly where your organisation stands today.
Prioritise the fixes
We hand over prioritised recommendations that tell you where to focus first and what good evidence looks like.
Where the recommendations call for new controls, our policy development team can write the supplier standards and procedures with you.
Why Third-Party Risk Is Rising
Tier-one contractor compliance
Supply Chain Risk Management and the Modern Slavery Act
If your organisation supplies goods or services in the UK and turns over £36m or more, section 54 of the Modern Slavery Act 2015 requires you to publish a slavery and human trafficking statement every financial year. Forced labour is the most common form of modern slavery, and it is common in construction.
The Home Office statutory guidance expects your statement to show real due diligence and risk assessment across your supply chain. A maturity ranking with prioritised actions gives you that evidence, year after year.
The cost of a third-party failure keeps climbing. In a Deloitte survey, almost half of organisations say its financial impact has doubled in 5 years, and the reputational damage can cost you work and clients.
Our safety people work on live construction projects, so we review sub-contract packages and payment runs as they operate on site.
Related engagements
See the Evidence Behind the Review
Multiplex pilot
How the maturity model was trialled against one of Multiplex's biggest sub-contractors in 2021.
Audits and inspections
Independent site audits that check your controls work on the ground, across your own teams and your contractors.
Safety consulting
Our full consulting hub: audits, accident investigation, CDM, PSCS and PSDP, and policy development.
Questions compliance leads ask
Third-Party Risk Questions Answered
What is third-party risk management?
Third-party risk management is how you find, assess and control the risk you inherit from the businesses you rely on. The usual third-party risk lifecycle starts with identifying those businesses and ends with monitoring them until the contract closes. In construction the hardest part is visibility: knowing what happens 2 or 3 levels down your sub-contract chain.
How is construction third-party risk different from vendor risk management?
Most vendor risk management tools and vendor risk assessment questionnaires focus on cyber security and data access. Those matter, and data protection is one of the risk areas we assess. On a tier-one project, though, the bigger exposure is usually labour: who is on site, how they were recruited, and how they are paid. We built our model around that reality.
Does the Modern Slavery Act apply to my organisation?
Section 54 of the Modern Slavery Act 2015 applies if your organisation supplies goods or services in the UK and has a total annual turnover of £36m or more. You must then publish a slavery and human trafficking statement for each financial year. Below the threshold, your tier-one clients may still ask you for the same evidence.
What do we get at the end of a supply-chain risk review?
You get a maturity ranking across the 4 areas and a set of prioritised recommendations, so you can see where you stand and where to act first. In the Multiplex pilot that meant clear advice on the greatest areas of risk across quality, reputation, workers' status and conditions, and data protection.
Is third-party risk a legal job or a safety job?
It is both, and it also belongs to procurement and finance. Lawyers can draft the statement and the contract clauses. The evidence behind them comes from your sites and your supplier records. We bring construction, safety and labour expertise to that operational side, and we work alongside your legal team.
CMIOSH · Multiplex pilot · 4-area maturity model
Put Your Third-Party Risk Management on the Front Foot
Tell us about your supply chain and the projects you want covered. We scope the review with you and show you where your biggest third-party risks sit.
Request a supply-chain risk review