Procurement due diligence
Compare two vendors' chains before you sign one of them, rather than discovering the difference at renewal.
The problem, what happens today, and what we do instead.
Procurement cannot compare two vendors' chains before signing.
Today Questionnaire answers, taken on trust, about a list the vendor wrote itself.
With Subprocessor monitoring Compare mode puts both closures side by side — shared providers, what only the first one brings, what only the second one brings.
Concentration is invisible at the point of decision.
Today An assumption that the two candidates are roughly equivalent underneath.
With Subprocessor monitoring Concentration per candidate, as a share of the chain terminating at each major provider. Two vendors that look different at depth 1 often terminate at the same three companies.
The questionnaire answer is a point in time.
Today A PDF filed in a folder, never revisited.
With Subprocessor monitoring The comparison is computed from disclosures we refetch daily, and it changes when the vendor does.
The interesting output of a comparison is rarely the difference. It is how much of the chain the two candidates share, because shared providers are the ones where switching vendors does not change your exposure at all.
What the comparison shows
- Providers both candidates reach, which is where switching buys you nothing
- Providers only the first candidate reaches, at what depth and through which discloser
- Providers only the second candidate reaches
- Concentration for each candidate, so a shorter list is not mistaken for a smaller blast radius
- Coverage for each candidate, so a thin graph is not mistaken for a clean one
Read it against the coverage number
A candidate whose graph resolves at 40 percent and a candidate that resolves at 80 percent are not comparable on list length. The one with the shorter list may simply be the one whose subprocessors publish less. Coverage travels with every comparison for exactly this reason.
You can run a comparison on any two companies in the public dataset without an account. See the directory for what is in it.
Start with one vendor. Free, and no card.
Search a company, follow it, and see the chain beneath it. Upgrade when one vendor stops being enough.