ProcureTech Insider

What Does Good Digitally-Enabled Supplier Management look like?

Good starts with policy. Not a document that describes how you would like to govern, but policy expressed once and fanned out digitally, so that it lands on the suppliers, the contracts and the services you actually want to govern — and lands so easily that nobody in the business experiences it as extra work.

That is the definition Jesse Lee, Co-founder and CEO of Brooklyn Solutions, arrived at on the Art of Procurement ProcureTech Insider podcast with Jyothi Hartley. It is a more demanding answer than it first appears, because it asks procurement to treat policy as a distribution mechanism rather than a statement of intent.

“It just has to be so easy. It can’t be more homework that anyone has to do.”

— Jesse Lee, Co-founder & CEO, Brooklyn Solutions

Jesse Lee on the Art of Procurement ProcureTech Insider podcast with Jyothi Hartley.

Why Does Policy Come Before Technology?

Because without a governing intent, digitisation only makes fragmentation faster. Asked what good looks like, the instinct is to answer with software. Jesse Lee starts somewhere else: you cannot get to the good, he argues, until there is “some method and reason to the madness, and that we think of as policy.”

The reasoning holds up when you look at what supplier management now covers. Onboarding, risk, compliance, performance and governance all run at once, usually across teams and systems that were never designed to talk to each other. Buy a tool for each of those and you have digitised the silos rather than removed them. Jesse Lee’s warning to procurement leaders evaluating technology is blunt on this point:

“If you’re only solving the challenge that’s ten feet in front of you, next year you may be complaining about living in another silo.”

Policy is what stops that happening, because it is the one artefact that already spans every one of those functions. It states what the organisation expects, of whom, and to what standard. The digital question is not whether you have written it down; almost everyone has, but whether it reaches anything.

Policy on SharePoint VS Policy that is Digitally Embedded

The clearest way to hear the difference is in Jesse Lee’s own comparison of what good and not-so-good look like in practice.

“Good starts with policy. Not-so-good looks like a PDF stored on SharePoint that everyone is supposed to read and apply. Good looks like that policy is digitally embedded: it lands on the suppliers, the contracts, and the services you want to govern. Activities that fulfil those policies are audited without preparation.”

“Audited without preparation” is the phrase to sit with. If a governance question can only be answered by a person gathering evidence, the policy is not embedded – It is being re-enacted by hand each time somebody asks.

What is the policy actually governing for?

Three outcomes, in Jesse Lee’s framing: value for money, operational resilience, and — once in a while — an innovation pursuit. Each one changes what “digitally enabled” has to mean in practice.

Value for Money

A contract is not a filing obligation. As Jesse Lee puts it, “a contract expresses a value exchange, but it also expresses an allocation of risk.” That reframes the digital requirement: if the commercial terms and the risk position sit in a document nobody outside the contract team can read, then value is being managed by whoever happens to remember it. Brooklyn’s own view is that procurement exists “to accelerate the roadmap of your business” — which is hard to do from a repository.

Operational Resilience

“At the core of all of it is operational resilience,” Jesse Lee says. “The business must persist.” This is where policy stops being a matter of good practice and starts being a matter of law, and he points to the regulatory shift that made it so: “Years ago, regulators said you could no longer outsource responsibility for data protection to your suppliers. You are responsible.”

The regulators have been explicit about it. The Information Commissioner’s Office states that “a controller is primarily responsible for its own compliance and ensuring the compliance of its processors” — responsibility that extends to checking a processor can offer sufficient guarantees before appointment, and monitoring them on an ongoing basis afterwards. In financial services the bar is higher again: the EU’s Digital Operational Resilience Act entered into application on 17 January 2025, bringing third-party monitoring and specific contractual provisions into supervisory scope.

Neither obligation can be met by a policy nobody has read. Both are, in effect, requirements to demonstrate governance on demand — which is precisely the “audited without preparation” standard.

Innovation, Once in a While

The third outcome is the one most easily lost. Jesse Lee treats innovation as an occasional pursuit rather than a constant — something resilience earns you room for, once the business is no longer absorbing disruption. It is worth naming in policy for exactly that reason: if the only expectations you have digitised are defensive ones, the supplier relationships that could contribute something new have no route to do so.

Two Tests for Whether your Policy is really Embedded

Both come straight out of the conversation, and both are usefully awkward to answer.

1. “How do I know that it’s even expected?”

Jesse Lee’s test for whether governance exists at all: “How do I know that it’s even expected? Well, it’s in policy and it should be readily apparent.” Readily apparent to the person doing the work, at the moment they are doing it — not discoverable by someone who knows where to look. If a category manager has to ask whether a check applies to this supplier, the expectation has not landed.

2. “It can’t be more homework”

The adoption test. Governance that adds a parallel process gets worked around, and the workaround becomes the real process. Jesse Lee applies the same standard to data sharing across functions: “Data available to multiple people pays dividends… we think the different functions should be well connected to each other, and it has to be easy. It can’t become more homework for anyone.”

He pairs it with an observation about who benefits: “Those who embrace transparency get rewarded for it.” The reward is not moral. Shared risk and contract data lets contract management, supplier management and risk management act on the same facts instead of reconciling three versions of them.

Where Should Procurement Leaders Start?

With a roadmap, and with a clear answer to what the technology is for. Jesse Lee is direct about the first: “If you don’t, close the door and make one. Connect what you’re doing to the business roadmap and think a few years ahead. Take a holistic, future-proof approach.”

On the second, he is sharper still — and it applies to any capability being bought at the moment: “People say they want AI. The real question is, ‘To do what?’ That’s the business objective you need to define first.” Policy is what makes that question answerable, because it is where the objective is already written down.

In practice that means the pieces have to be connected rather than bought separately. Brooklyn’s platform treats policy and regulatory compliance, supplier relationship management, contract lifecycle management and third-party risk management as interconnected elements of one discipline, governed under a single governance, risk and compliance view which is what allows a policy to be expressed once and land everywhere it needs to.