Death by a Thousand Vendors: Who Is Actually Looking Out for the Organization?

The Instinct

When an organization needs a capability it does not have, the most logical path is to find someone who does. A vendor is engaged. A contract is signed. A box is checked. The need, at least on paper, is met.

Vendors serve a legitimate purpose. The problem is what tends not to happen before any of that occurs. There is rarely a serious conversation about whether the organization should build the capability itself, what it would mean to retain that knowledge internally over time, or what the total cost of the relationship will look like not at signing, but three years in. Those questions require a philosophy about what the organization is actually for, and what it should know how to do on its own. Most organizations have not developed one, and there is very little incentive to do so.

It is easier to engage a vendor than to answer harder questions about strategic priorities, core competencies, and long-term capability building. So the harder questions tend not to get asked.

The Gap

Without a deliberate view on what to own versus what to delegate, vendor decisions get made in isolation. Build vs. buy becomes a budget conversation rather than a strategic one. The person championing a vendor is rarely the one who will manage the relationship, absorb its operational costs, or be accountable for its failures. The benefits of a new relationship are visible and easy to quantify. The costs are not.

This is not a complicated idea. A household that hires someone to handle every repair eventually loses the ability to evaluate whether the work is being done well, what it should cost, or when it is time to find someone else. Organizations are not so different. Delegating execution is reasonable. Delegating judgment is a different matter entirely.

The costs that never make it into the original business case have a way of arriving anyway. Oversight functions grow quietly as vendor populations expand, until the resources required to monitor, escalate, and manage those relationships exceed what anyone anticipated. Concentration risk presents its own push and pull. Overdiversify, and oversight capacity gets stretched thin while negotiating leverage evaporates. Overconcentrate, particularly in critical areas, and operational resilience, regulatory standing, and the ability to absorb a disruption all come into question. Neither outcome was chosen deliberately. Both arrived through a series of decisions that each seemed reasonable at the time.

The Better Question

The answer is not to limit vendor spend or restrict engagements. Organizations that try to solve this problem through prohibition tend to drive decisions underground rather than improve them.

The better question is strategic. What is this organization actually for? Where does it want to build and retain expertise? What should it know how to evaluate, even if it delegates execution? What relationships, if they failed or became unavailable tomorrow, would leave it genuinely exposed?

A vendor strategy does not need to be a written artifact. But its existence should be evident. The absence of one is usually because no one was incentivized to create it or held accountable to follow it. There is no reward for asking hard questions about organizational capability before a vendor is engaged, no recognition for the leader who slows a decision down to pressure-test a build vs. buy assumption, and no consequence for the costs that arrive years later under someone else's watch. So the strategy never gets developed. You should be able to find its fingerprints in organizational design, in delegated authority, in what requires escalation and what does not. When those fingerprints are absent, the organization has not made a strategic choice about outsourcing. It has simply accumulated one.

The instinct is to ask whether a vendor can do the job. The better question is whether the organization has thought carefully enough about which jobs should be theirs in the first place.

That question rarely gets asked. It is worth asking who has the authority to answer it, and whether they have any incentive to try. In most organizations, the honest answer is that no single person does. The question falls into the space between functions, between incentives, and between who benefits and who is ultimately accountable.

Which raises a harder question still. At the end of the day, who is actually looking out for the organization?