Most organisations have established processes for managing risks associated with their direct suppliers, contractors and service providers. Contracts, supplier assessments, audits, certifications and periodic reviews provide an important foundation for third-party risk management. As supply chains have become more interconnected, boards and management teams are increasingly extending that view beyond direct suppliers to understand the wider network that supports the business.

Nth-party risk refers to the subcontractors, service providers, raw-material sources and technology dependencies that sit behind an organisation’s direct suppliers. Boards do not need a complete map of every entity in a global supply chain. What they need is enough visibility to understand the critical dependencies, where material exposure may sit, and whether the right governance and escalation arrangements are in place.

Extending Visibility Beyond Direct Suppliers

Most organisations have strong visibility over Tier 1 suppliers, while visibility tends to reduce further down the chain. McKinsey’s Supply Chain Risk Pulse reported that 95% of organisations had visibility of the Tier 1 supplier risks, compared with 42% beyond the first tier. The BCI Supply Chain Resilience Report also showed that the proportion of organisations analysing critical suppliers to Tier 4 and beyond increased from 3.7% in 2023 to 17.1% in 2024.

The data shows that supply-chain visibility is gradually extending beyond Tier 1. It also highlights an important distinction: knowing that a supplier exists is not the same as understanding the risk it may carry. Useful visibility means understanding factors such as financial condition, cyber exposure, labour practices, geographic concentration and vulnerability to disruption. For the board, the important question is whether management is focusing on the dependencies that matter most and whether those exposures are consistent with the organisation’s risk appetite.

Broadening the View of Supply Chain Risk

Nth-party risk goes well beyond responsible sourcing, labour practices and ESG. A problem several tiers away can surface as an operational, cyber, financial, regulatory, geopolitical or environmental issue. A vulnerability in a software component can affect downstream users, disruption at a logistics subcontractor can delay deliveries, and labour or environmental issues at source can create reputational or regulatory consequences for the company whose name appears on the final product.

Recent events illustrate this broader exposure. Top Glove and Sime Darby Plantation both faced US import restrictions linked to labour concerns and subsequently undertook significant remediation measures. In a different context, Toyota reduced global vehicle output during the 2021 semiconductor shortage as disruptions affected packaging facilities further down its supply chain. These cases show that established Tier 1 controls remain essential, while greater visibility into critical lower-tier dependencies can help organisations identify vulnerabilities earlier and respond more effectively.

A Wider Regulatory Lens

Global supply chains operate across several regulatory environments at the same time. Raw materials may originate in one country, processing may take place in another, and the finished product may be sold in markets with very different requirements. Rules relating to forced labour, modern slavery, deforestation, data protection, anti-bribery and sustainability increasingly require organisations to understand more about their wider value chains.

For Malaysian companies that export to regulated markets or supply multinational customers, these expectations can travel through commercial relationships as well as through domestic law. Supplier oversight therefore needs to consider where inputs originate, what activities take place along the chain, and which market or customer standards apply. A company may meet local requirements and still face disruption, remediation demands or loss of business if a lower-tier supplier falls short of the standards expected in an end market.

Building an Exising Supplier Assurance

Certifications, audits and supplier declarations remain important parts of supplier assurance. Increasingly, organisations are complementing these established controls with deeper traceability and external sources of information where the risk profile justifies it. Nestlé’s responsible palm-oil programme is one example. Following concerns over deforestation, the company progressively added deeper supply-chain mapping, satellite monitoring, plantation-level traceability, smallholder engagement and public reporting.

Not every organisation needs the same technology or the same depth of monitoring. The right approach depends on where the material risk sits. Assurance becomes stronger when traceability and oversight reach that point in the chain. Nth-party risk management should therefore be seen as an extension of existing supplier controls, rather than a replacement for them.

Extending Enterprise Risk Management

Nth-party risk can be incorporated into existing enterprise risk management without creating a separate governance system. The familiar process remains the same: identify the risk, assess its significance, determine appetite, decide how it should be treated and monitor how exposure changes over time. What changes is the field of view. Assessment may need to consider supplier tier, geography, concentration and the nature of the risk, while treatment may include stronger contractual requirements, alternative sourcing, enhanced due diligence or more continuous monitoring. Responsibility will depend on the type of exposure. Procurement may lead supplier engagement, with cyber security, sustainability, compliance, operations, finance and business continuity contributing where relevant. The board does not need operational detail from every tier. It needs confidence that material dependencies have been identified, ownership is clear and exposures outside risk appetite are escalated in a timely manner.

Questions the Risk Committee Should Be Asking

The Risk Committee can build on existing supplier and enterprise risk reporting by adding a concise view of the organisation’s most important deeper-tier dependencies. Figure 2 offers six sample KRIs covering visibility, concentration, detection, geography, contractual flow-down and responsiveness. Each board can set its own thresholds, ownership and reporting frequency to reflect the organisation’s risk profile.

Prioritising Risk and Improving Visibility

A practical Nth-party approach does not require organisations to map every supplier to the end of the chain. Resources should be directed towards dependencies that could have the greatest impact. Purchasing spend remains an important commercial measure, but factors such as cyber exposure, ESG risk, concentration, regulatory exposure and financial resilience can help identify where deeper visibility will add the most value.

Annual questionnaires, audits and supplier reviews also remain useful foundations. Many organisations are now supplementing them with more timely information from supplier-mapping tools, cyber-risk ratings, ESG intelligence, geospatial monitoring, news alerts and automated screening. Technology should support the risk-management process rather than drive it. The starting point remains the same: identify the critical suppliers and understand the important dependencies behind them.

A Practical Way Forward

A practical starting point is to identify the supply chains whose disruption would have the greatest operational, financial or reputational impact. Management can then look beyond Tier 1 where that impact justifies the effort, prioritise lower-tier dependencies using a broader set of risk factors, and increase the frequency or depth of monitoring as better information becomes available. Figure 3 shows how this can develop from established periodic controls towards more proactive and intelligence-driven oversight.

The appropriate level of investment will differ by sector and business model. A global manufacturer with complex commodity supply chains will need a different approach from a professional-services company, but the principle is the same: visibility should broadly reflect the materiality of the risk. The journey can also be phased. Initial work may focus on the most critical products, suppliers or markets, with visibility extended as data quality improves and the business case becomes clearer. This keeps the approach practical and gives management and the board an opportunity to learn from early results before expanding the programme.

Extending the Board’s Oversight

Boards already oversee supply chain, third-party and enterprise risks. Nth-party risk management extends that oversight by providing a clearer view of critical dependencies beyond direct suppliers and how those exposures compare with the organisation’s risk appetite. A useful Risk Committee discussion can begin with a simple question: how much visibility do we have beyond our direct suppliers in the areas most critical to the business, and where would greater visibility improve our oversight?

As supply chains become more interconnected and regulatory expectations reach further into value chains, this wider view is becoming increasingly useful. The aim is not complete visibility for its own sake. It is to understand the lower-tier dependencies that could materially affect the business and to strengthen the supplier and enterprise risk work that is already under way.

The article was written by Salman Nazir.

Photo by Cooper Hofmann on Unsplash.