A subcontractor appears without our knowledge. What should happen?
Unclear subcontracting exposureConfirm the subcontractor's role, access, responsibilities, and authorization with the commercial and security owners. The primary supplier's involvement does not automatically resolve data or control concerns.
What to do now
- Identify the subcontracted work
- Check contractual and policy requirements
- Review access and relevant risks
- Obtain the required authorization and controls
When to escalate
Sensitive access or essential work has been delegated improperly.
The authorized procurement or commercial owner
Example
A specialist subcontractor receives scoped access only after the appropriate review.
Mistake to avoid
Allowing unknown parties into the workspace because the main vendor requested it.
Prevent a repeat
Compare supplier evidence with agreed obligations; refer contract interpretation and remedies to qualified owners.
Suggested ApprovedFlow setup
- Vendors
- Documents
- Tasks
- Approvals
Keep supplier commitments and evidence linked to the project, assign follow-up work, and route commercial decisions to authorized owners. See the platform
Related cases
- The vendor says knowledge transfer is not included. How do we respond?Missing supplier transition scope
- The vendor's proposal is vague about deliverables. What should be clarified?Ambiguous supplier scope
- Incidents bounce between vendor, IT, and business teams. How do we stop that?Unclear incident coordination
- The same dependency appears in many project plans. Who should own it?Shared dependency governance