Vendor consolidation, fewer suppliers, and a different risk profile

A register of 400 suppliers cannot be assessed properly by a team of three. Every vendor removed is one fewer set of credentials, integrations, DPAs, reassessments and offboarding obligations — and the vendors most worth removing are usually the long tail of small tools with data access, low spend and no owner, which is exactly the population that never gets reviewed.

Consolidation also raises the quality of what remains. Depth of oversight is finite: forty relationships reviewed properly is a stronger position than four hundred reviewed nominally, and the arithmetic is why consolidation is often the highest-value risk reduction available to a programme that is under-resourced rather than under-skilled.

Fewer suppliers means more of the business depends on each one. That is concentration risk, and consolidating without recognising it converts a diffuse problem into a sharp one: a single platform outage that once affected one process now stops four.

Manage it explicitly. Where consolidation makes a supplier critical, it should move up a tier and inherit the diligence, contractual terms and exit expectations of that tier — including an exit plan that has been tested rather than drafted. The point is not to avoid consolidation; it is to stop the risk profile changing silently while the cost saving is being reported.