Suppliers and Outsourcing

The First 90 Days: How to Stabilise IT, Cyber and Compliance Together

Why the first 90 days with a new provider or IT leader decide the next three years, and five priorities to get right.

lpunton

Oct 154 min read

How to Switch IT Provider Without Losing Control

Introduction The handover risk most organisations underestimate Changing IT provider should mean better support, stronger security and more peace of mind. Yet most organisations put their effort into choosing the new provider and very little into the handover itself. That's where things go wrong. Know-how gets lost, nobody is quite sure who is responsible for what, and gaps appear just when you need everything to keep running. So the real question isn't only "Is the new provi

lpunton

Oct 25 min read

The Customer’s Role in Managed IT: Why Shared Responsibility Must Be Clear

Many organizations procure managed IT services expecting risk and responsibility to transfer to their provider. However, while an MSP offers operational capability and expertise, accountability for business outcomes, information assets, compliance, and risk remains with the customer. Poorly defined roles lead to assumptions, creating gaps that cause service failures, security incidents, and disputes. For boards and leadership teams, understanding shared responsibility is a go

ipunton

Sep 93 min read

Controlling Third-Party Risk in a Predominantly Outsourced IT Environment

Outsourcing IT services has become standard across UK-regulated sectors, including schools, legal firms, and public bodies. While outsourcing provides access to specialist capabilities and operational efficiencies, it has potential to also introduce significant risk. When much of your IT stack is managed by third parties, supplier risk becomes a governance responsibility at the board level—not just an IT issue. Boards, trustees, and regulators increasingly expect clear eviden

ipunton

Jun 105 min read

Navigating Supplier Risk in Regulated Sectors: A Governance Perspective

Supplier relationships are vital for organisations in regulated sectors such as schools, legal firms, accountancy practices, professional services, and the public sector. Yet, managing supplier risk remains a persistent challenge for many boards, trustees, and regulators. When supplier risk is overlooked or poorly controlled, it can lead to operational disruption, regulatory non-compliance (including UK GDPR breaches), financial exposure, and reputational damage, often dispro

ageal8

Jun 35 min read