The Layer Beneath the Contract: Board Assurance Over Sub-Tier Partners

When a board approves a strategic partnership, it usually sees a single name on the paper: the prime contractor, the lead grantee, the anchor institution or the named delivery partner. That name carries accountability in the boardroom. It does not, however, carry all the work. Beneath the prime relationship sits a second layer of subcontractors, specialist suppliers, community delivery organisations and technical allies. The board may never meet them, yet their failure, conduct or capacity can reshape the partnership’s reputation and results.

This is not an argument for boards to manage sub-tier suppliers directly. It is an argument for governing the visibility gap between formal approval and operational reality. A partnership that looks coherent at signature can become fragmented at delivery if the board has no agreed route to see who is doing what, on what terms, and with what assurance.

Why the prime relationship is not the whole picture

Prime partners are often selected because they can integrate capability. That integration is valuable, but it also concentrates the board’s line of sight. The board sees the prime’s assurances, the prime’s reporting and the prime’s version of events. If a sub-tier partner is delivering a critical service, holding sensitive data or engaging directly with service users, the board’s assurance is only as good as the prime’s oversight of that layer.

In UK public services, framework agreements, consortium bids and place-based programmes make this especially common. A local authority may contract with a lead organisation that then works through several specialist providers. An NHS partnership may depend on a small technology supplier beneath a larger systems integrator. A regional growth programme may rely on community organisations that are invisible in the main governance pack but central to delivery.

The governance question is not whether sub-tier arrangements exist. They usually should. The question is whether the board has enough structured visibility to know where its risk appetite is being tested.

Mapping dependencies before they become surprises

A useful starting point is a dependency map, but it should be selective. Boards do not need a register of every purchase order. They need a view of the second-tier relationships that could materially affect the partnership’s purpose, continuity, compliance or public standing.

A practical map might identify sub-tier partners that meet one or more criteria: they deliver a service directly to beneficiaries or customers; they hold or process significant data; they provide a capability with no ready substitute; they employ staff in regulated or safety-critical roles; they carry a significant share of delivery risk; or they are likely to attract public or regulatory attention if something goes wrong.

Each entry should record the nature of the dependency, the prime partner’s oversight arrangement, the board’s agreed visibility level and the route for escalation. The map should be reviewed at a sensible interval, not treated as a one-off due diligence artefact. Partnerships change. A small supplier can become critical; a specialist provider can become a single point of failure; a community partner can become the public face of the programme.

Visibility rights worth writing down

The board’s ability to see into the second tier should not depend on goodwill or a standing invitation to ask questions. It should be set out in the partnership agreement or governance charter. Visibility rights can be proportionate and still meaningful.

Useful provisions include a right to receive a list of material sub-tier partners, a description of their role and a summary of the prime’s assurance over them. The board may also require notification of significant changes: a sub-tier partner exiting, a material dispute, a safeguarding incident, a data breach or a substantial change in the scope of work. In some cases, a right to meet key sub-tier leads once a year, or to receive their perspective through a shared assurance session, can be more informative than another layer of written reporting.

The aim is not surveillance. It is to establish predictable access to the information the board needs when its risk appetite is engaged. Visibility rights should be agreed early, recorded clearly and explained to the prime partner as part of a mature governance relationship rather than as a sign of distrust.

Escalation routes that reach the work

Many partnership agreements contain escalation clauses that operate only between the board and the prime. That is appropriate for contractual authority, but it can leave a gap when an issue originates below the prime. Boards should ask how a concern from a sub-tier partner reaches the partnership’s governance structure, and how a board-level decision travels back down.

A workable escalation route might involve a standing delivery forum where sub-tier issues are discussed, a defined threshold for bringing matters to the partnership board, and a named board contact for exceptional concerns. The route should distinguish between operational performance issues, which may sit with management, and matters that engage the board’s risk appetite, such as regulatory breach, reputational exposure or the withdrawal of a critical capability.

Clarity matters more than complexity. If the route is too elaborate, it will not be used. If it is too vague, it will be bypassed. The test is whether a reasonable person in a sub-tier organisation would know how to raise a material concern and what would happen next.

Testing risk appetite at delivery level

Boards often describe risk appetite in broad terms: low tolerance for regulatory breach, cautious about reputational exposure, willing to accept managed delivery risk. Those statements need to be tested against the second tier. A board that is risk-averse on data protection should know whether sub-tier suppliers are handling personal data under equivalent controls. A board that prioritises continuity should know where single points of failure sit.

A light-touch assurance exercise can be revealing. Take three or four material sub-tier dependencies and ask: what would happen if this partner failed, withdrew or behaved poorly? What would the board see, when, and through whom? Would the board’s stated risk appetite still hold? The answers should inform both the dependency map and the partnership’s assurance plan.

A board routine, not a one-off exercise

Second-tier governance works best as a modest routine: a dependency map reviewed periodically, visibility rights recorded in the agreement, escalation routes tested through scenario discussion, and a short assurance report that brings material sub-tier matters into the board’s view. It should sit alongside the board’s existing oversight of the prime relationship, not replace it.

The board does not need to meet every partner beneath the contract. It does need to know where the partnership’s delivery actually rests, and whether its risk appetite reaches that far. Good governance is not about seeing everything. It is about being confident that the things the board cannot see are being governed with the same care as the things it can.