By Keila Janaina Israel, Supplier Contracts supervisor, SONDA do Brasil.
For years, supplier approval was considered a bureaucratic procurement step. That perception changed as compliance gained relevance.
In Brazil, the Anti-Corruption Law and Lava Jato investigations intensified scrutiny of third-party due diligence, while labour violations reinforced concerns that corporate risks extend beyond internal operations.
Technology partnerships have made these concerns increasingly urgent.
Previously, major technology companies expanded capabilities through acquisitions. Today, rapid innovation makes concentrating every necessary skill internally increasingly difficult.
Artificial intelligence, cloud, cybersecurity, data and automation are advancing rapidly. Meanwhile, start-ups and specialist companies provide innovation and expertise that complement larger projects. Building partnerships and ecosystems has therefore become increasingly strategic.
KPMG’s 2026 global third-party risk management survey, covering 851 organisations, found that 83% of executives intend to expand partner networks within three years. Regulatory compliance and cyber risks remain major management priorities.
However, different operating models create challenges. Start-ups typically operate with lean processes and rapid decisions, while large organisations maintain complex governance structures and approval requirements.
Reconciling commercial agility with effective controls becomes essential when multiple companies contribute to project delivery.
Who assumes responsibility when a project depends on several partners?
Customers generally contract one company to deliver a solution. Financial, legal, reputational, operational or security failures involving partners can therefore compromise the entire project.
Third-party management must begin before participation. Companies need clarity about partner responsibilities, data access, operational dependencies and potential disruption.
The World Economic Forum’s Global Cybersecurity Outlook 2026 reported that 65% of large companies identified third-party and supply chain vulnerabilities as their biggest cyber resilience challenge, compared with 54% in 2025.
Although 66% assess vendor security maturity, only 33% comprehensively map ecosystem interdependencies and threat exposure.
Supplier homologation consequently extends beyond procurement compliance. Unlike registration, which collects administrative information, homologation evaluates whether partners satisfy legal, financial, operational, compliance and information security requirements.
The challenge is balancing speed against control.
Lengthy approval procedures can obstruct commercial opportunities and exclude innovative partners. Conversely, insufficient assessment exposes projects to risks emerging after contracts are signed.
This is particularly important for start-ups. Their specialist capabilities and agility can accelerate innovation, but applying approval procedures designed for major suppliers may undermine those advantages.
Risk-based criteria should preserve flexibility without compromising security.
Initial assessments are insufficient because financial, legal and operational circumstances can change. Homologation must therefore evolve into continuous monitoring throughout commercial relationships.
This responsibility also changes how procurement teams operate. Rather than treating checks as a final administrative hurdle, businesses must integrate risk evaluation into partnership planning. Clear expectations, proportionate controls and regular reviews can help emerging companies participate in major projects while giving customers greater confidence in the resilience of interconnected technology services worldwide.
As technology ecosystems expand, competitive advantage increasingly depends on effective collaboration.
However, greater dependence on partners demands stronger governance, proportionate assessment and sustained oversight.
Companies must avoid turning governance into unnecessary delays or commercial speed into unacceptable exposure.
Ultimately, organisations delivering complex technology projects remain responsible not only for their own capabilities but also for the partners selected to support delivery.
