Third-Party Dependencies: The Critical Path Nobody Keeps an Inventory Of

Asked during a due diligence session which external providers the business depends on, a technical team will typically name three or four: a cloud platform, a payment processor, perhaps a data source. Reconstruct the same question from procurement records, monthly card statements, and the configuration files of the production environment, and the resulting list is often an order of magnitude longer. The divergence does not arise from anyone withholding information. Most dependencies enter the estate not as decisions but as conveniences, adopted to remove friction at a particular moment, and over time those conveniences settle onto the operational critical path without ever being reclassified. The question the company has never put to itself is the first question the reviewing party asks, and that asymmetry sets the tone of the table within the opening hour.

The same pattern shows its second face during interruptions. On a morning when an external service becomes unreachable, the answer to how long the organisation can continue to operate resides not in a document but in the recollection of two or three people, and recollection does not transfer through a handover. The dependency itself is not the problem at this point; no company manufactures every layer internally, and attempting to do so would be difficult to defend as a use of capital. The problem is that nothing on record establishes whether the dependency was adopted as a deliberate structural choice, and if it was, under what assumptions about availability, price trajectory, and substitutability that choice was made.

The mechanism operating underneath is organisational rather than cognitive, and it has two layers. In the first, convenience appears costless: bringing an external service into production registers as a modest monthly line item, while the obligation it creates — loss of data portability, the surrender of interface compatibility to the provider's roadmap, a lengthening replacement horizon — carries no entry in any ledger. In the second, the person who creates the dependency and the person who eventually pays for it are not the same person. The engineer completing the integration gains velocity; the invoice arrives two years later, in a renewal negotiation or a migration programme staffed by a different team. The choice is rational to the extent that it genuinely lowers near-term cost. Rationality ends where conditions change, the choice remains fixed, and nobody carries the mandate to reopen it.

In its matured form, the mechanism produces dependencies that exist at the level of documentation while remaining absent at the level of practice. A service level commitment sits in the contract file, yet in none of the instances where that commitment was breached has any remedy been claimed; because provider performance is not tracked, whether a breach occurred at all remains unknown. Renewal follows the same shape: the agreement is annual, but no criterion governs the renewal decision, so renewal becomes effectively automatic and price escalation moves outside the field of negotiation. Documentation is present, practice is not, and a reviewing party detects the gap within the first week, since the inconsistency between reading the contract and reading the invoice series does not conceal itself.

The institutional cost appears first in the assumption layer of the valuation. In the buyer's model, the operating expense projection for external providers is built not from historical growth but from the maximum escalation the contract permits; where the contract defines no ceiling, a conservative one is assumed on the buyer's behalf. Where a critical provider is single-sourced and no substantiated replacement timeline can be produced, the model does not push an outage scenario through the revenue line — it prices it into the discount rate. These are negotiable assumptions, but negotiating them requires the counterparty to hold numbers. Absent numbers, the assumption is delegated to the buyer's conservatism, and that delegation on its own produces measurable erosion in the multiple.

The second channel of cost is the transaction structure itself. Where the dependency map is incomplete, buyers absorb the uncertainty not through price but through protective mechanics: a specific representation on the assignability of third-party agreements enters the warranty schedule, the escrow proportion rises and the escrow period extends beyond the customary term, and consents from critical providers appear among the conditions precedent. The time required to obtain those consents frequently becomes the item that actually governs the closing calendar; and where a provider reads a change-of-control consent as an occasion for price revision, the company enters a negotiation under closing pressure with no leverage whatsoever. At this point the absence of an inventory stops being a documentation shortfall and becomes a transaction risk with direct cash consequences.

The third channel is the convergence of the ownership vacuum with founder dependency. Where the commercial side of provider relationships sits in finance, the technical side in engineering, and the contractual side in legal, but no function owns the whole, one person in practice holds the entire estate in their head, and that person is usually the founder or the first technical lead. Review does not classify this as an organisational shortcoming; it classifies it as an asset that cannot be transferred, since the acquired company's continued operation depends on the retention of a single individual with a meaningful probability of departure within a year of closing. The corresponding remedies are an extended earn-out and key-person retention arrangements, both of which defer the seller's access to cash.

Structural intervention is built from four separable components rather than from individual vigilance. The first is the dependency inventory: for every external provider, a single record capturing what the service does, which business process halts without it, the contract term and renewal mechanics, data ownership and export rights, and the estimated time and cost of replacement. The second is criticality classification — three tiers keyed to how many hours an interruption takes to stop operations are sufficient, provided the tier is validated by the commercial side and not by engineering alone. The third is a measurement regime: for every provider in the critical tier, availability, response time, and incident counts are recorded monthly, and commitment breaches are notified in writing at the moment they occur. The fourth is named ownership, with a commercial owner and a technical owner identified separately for each provider, and renewal decided by those two signatures against the inventory data.

BEIREK's intervention in this area is not to compile an inventory once and hand it over, but to install the cadence that binds the inventory to the decision moment. The dependency record becomes a mandatory step at the point a new provider is brought into production — opened when the service request is raised rather than after the contract is signed, with the replacement-plan field closed to omission. The renewal calendar is synchronised with the financial calendar, and for every contract in the critical tier a review session is convened sufficiently ahead of the renewal date, with measurement data placed on the table. The output of that session is not a renewal; it is a three-way decision: renew, reopen the terms, or initiate substitution.

The second line of intervention converts the dependency map, in transaction preparation, from a defensive document into a negotiating instrument. Assignability provisions are folded into renewal discussions before a transaction is on the horizon, at a moment when the provider holds no leverage to price them; data export rights and a defined exit support period are written into the agreement. What then reaches the review table is not a list of dependencies but a schedule in which each entry carries a replacement timeline, an exit cost, and a consent status. The zone of uncertainty from which a buyer would otherwise manufacture conservative assumptions narrows, and that narrowing registers directly in the escrow proportion and in the length of the conditions precedent list.

Building this structure does not aim at reducing dependency, nor should it; calibrated correctly, the use of external providers is capital efficiency in practice rather than a compromise of it. The objective is that every dependency exists as a deliberate choice with written terms, tracked performance, and an identified owner. What demonstrates a company's technical maturity is not that it depends on nothing, but that it can display on a single schedule what it depends on and to what degree; where that schedule exists, the subject of the review shifts from the existence of the risk to the quality with which the risk is managed.

The question at the review table is never whether the company uses external providers. The question is whether this company can demonstrate — in a meeting where the founder is not in the room — what happens when a critical provider is lost tomorrow, within how many days and at what cost the loss is remedied, and who holds the mandate to manage the remedy. The answer is priced, and so is the source from which the answer comes.