Business Continuity

Third-Party Risk in African Delivery Chains: The Sub-Contractor You Have Never Met

Diversion and sanctions exposure concentrate one relationship below your principal partner. Tiering due diligence by exposure and verifying it on a schedule.

By Mowlid Ali 27 Aug 2026 8 min Business Continuity
Source

Originally reported by UN Security Council Consolidated Sanctions List. INGO ADVISORY analysis is attributable to our intelligence desk; the underlying reporting remains the property of the publisher.

Read the original publication View all 3 citations
Author
Mowlid Ali
Source
UN Security Council Consolidated Sanctions List
Publication date
27 Aug 2026
Location
Africa — continental
Country
Africa (continental)
Category
Business Continuity
Threat level
MODERATE — An attack is possible, but not likely.
Analytic confidence
Moderate
Verification status
Verified
Listen · 2 minReady to play · about 2 min

Most organisations know their principal partners well and their sub-contractors barely at all. The risk sits in the second relationship.

What happened

Donor and lender scrutiny of downstream partners has tightened across African programmes, while the number of intermediaries in a typical delivery chain has grown. The result is a widening gap between contractual assurance on paper and verified reality in the field.

What is changing

Sanctions and beneficial-ownership screening now reaches further into local supply chains, particularly in transport, fuel, construction and security services. At the same time, verification by physical visit has become harder in exactly the districts where diversion risk is highest, which pushes organisations towards remote and third-party monitoring.

Why it matters

A failure at a sub-contractor is treated as a failure of the funded organisation. The consequences are financial, regulatory and reputational, and they arrive alongside the operational loss of the partner you were relying on.

Where the exposure sits

Exposure concentrates in transport and fuel supply, cash and voucher delivery, guarding contracts, warehousing, and any relationship established quickly during a surge response. Newly registered vendors with a single client and no verifiable premises deserve particular attention.

What organisations should watch

  • Vendors whose ownership cannot be established, or whose registration post-dates the tender.
  • Concentration risk: a single transporter or supplier carrying a disproportionate share of delivery.
  • Pricing that diverges from local market rates in either direction.
  • Adverse reporting on affiliates, and political exposure of owners in the districts where you operate.

What organisations should do

  • Tier due diligence by exposure — value, criticality and geography — rather than applying one template everywhere.
  • Verify existence physically or through independent monitoring at least once per contract cycle.
  • Re-screen on a schedule, not only at onboarding; ownership and sanctions status change mid-contract.
  • Require sub-contractor disclosure as a contractual condition, and audit against it.
  • Keep the evidence file complete enough that an external reviewer could reconstruct each decision.
Due diligence that happens once, at onboarding, describes a relationship that no longer exists.
Africa Risk Brief

Get the weekly Africa Risk Brief

Analysis like this — on business continuity and Africa's highest-risk operating environments — delivered every Monday. Free.

No spam. Unsubscribe anytime. We never share your email.