Third-party access

Suppliers arrive with their own habits, their own schedules and their own support contracts. The client's job is to give them exactly the reach they need, for exactly as long as they need it, and to be able to prove both afterwards.

Time-boxed by default

Every third-party grant we arrange carries a start and an end. The end date is agreed before the grant exists, printed in the brief, and reviewed if the supplier's work runs long. Extending a grant is a deliberate act with a name attached; it is never the unnoticed consequence of a calendar.

• Sponsor. One named person inside the client organisation who answers for the supplier's presence.
• Scope. The named systems and nothing else, written in the supplier's own vocabulary as well as ours.
• Window. Agreed hours, agreed notice for out-of-hours work, agreed contact for changes.
• Supervision. Who watches, whether a session is recorded, and where the record is kept.
• Close-out. The steps taken when the work ends and the evidence that they were taken.

Shared accounts, refused politely

Suppliers sometimes ask for a shared sign-in because it is convenient for their rota. We decline that in writing and offer an alternative that is nearly as convenient: individual grants for named engineers, issued in an afternoon, each with the supplier's own roster behind it. The client keeps provable accountability; the supplier keeps its working rhythm.

Ongoing support and monitoring relationships

Where a supplier holds a standing support responsibility, the arrangement is a permanent pattern rather than a single grant. We design it as such: a small set of standing roles, reviewed quarterly, with an agreed route for emergencies and a written rule about who may authorise one. Emergency routes are tested before they are needed, never during an incident.

Auditors and assessors

External auditors need broad but shallow reach: many systems, read-only where possible, for a short and declared period. We prepare that arrangement in advance so the audit week is spent auditing rather than negotiating. Findings the auditor raises about our own work are answered in writing and, where fair, accepted without argument.

When a supplier relationship ends

We prepare a close-out note listing the grants withdrawn, the sessions closed, the material returned or destroyed, and the records retained. It is signed by the client's sponsor. A close-out note is the cheapest insurance a client can hold, and it is the first thing an auditor asks for when a former supplier's name appears in an incident report.