Hidden Supplier Dependencies Left 2,600 Employees Without Payslips

A technology operations manager describes how 2,600 payslips failed to arrive in May because a payroll bureau relied on an undisclosed document delivery partner the company had never vetted or contracted with. An internal review of 17 key suppliers revealed that most shared the same underlying cloud infrastructure provider and region, meaning a single outage could simultaneously knock out expenses, HR, monitoring, and carrier systems. The organisation had sought vendor diversity but had unknowingly concentrated risk at the infrastructure layer. In response, the company built a supplier-of-suppliers register, added subprocessor change-notification clauses to contracts, and introduced continuity drills that rely solely on phones and manual processes. The author argues that resilience planning is shifting from an engineering discipline to one shared with procurement and legal teams, as critical dependencies increasingly lie outside direct visibility or control.