Strategy

When Two Suppliers Blame Each Other: Who Is Actually Responsible?

SKIMBOX Team

Your web agency says it is the payment provider. The payment provider says it is the integration. Nobody is lying, nobody is fixing it, and the accountability gap was created the day you signed two contracts that did not mention each other.

When Two Suppliers Blame Each Other: Who Is Actually Responsible?

Your checkout is failing for about one customer in twenty. Your web agency has looked at it and says the payment gateway is rejecting valid requests. The payment provider has looked at it and says they are responding correctly to what they receive.

Three weeks later, both are still right, the checkout is still failing, and you have spent a considerable amount of your own time carrying messages between two teams who have never spoken to each other.

The accountability gap was not created when the fault appeared. It was created the day you signed two contracts that did not mention each other.

Nobody is lying

This is worth establishing first, because the instinct is to assume somebody is covering something up, and that assumption makes the situation harder to resolve.

Each supplier is looking at their own logs. Those logs show their own system's behaviour, accurately. Your agency can demonstrate that a valid request left their server. The provider can demonstrate that they responded correctly to what arrived at theirs.

Both statements are true. The customer still cannot pay.

The fault lives in the space between the two systems, and neither supplier is contracted to examine that space, monitor it, or own it. It is not that they are refusing. It is that nobody ever assigned it, and each of them can see only up to their own edge.

Treating this as bad faith puts both parties on the defensive and makes them less willing to share the detail that would resolve it. Treat it as a visibility problem, because that is what it is.

Break the standoff with evidence

The single most effective move costs nothing and most people never make it: get both suppliers into the same conversation, at the same time, and insist on evidence rather than assertion.

Relaying messages does not work, and it is worth understanding why. You are acting as a translation layer between two technical teams while fully understanding neither. Detail gets lost at each hop. Each round trip takes a day. Each supplier answers the question they think you asked rather than the one the other party meant.

So: one call, both parties, and a specific ask.

Take one failing transaction, identified by a timestamp or reference number. Ask each side to show what they sent, what they received, and what they did with it. Not a summary. The actual request and response.

Two accounts of the same event, placed side by side, resolve within an hour what weeks of relayed messages could not. Either one account turns out to be wrong, in which case you have your answer, or both are correct, in which case you have located the problem precisely.

If a supplier resists joining that call, treat it as information and say so. A supplier confident that their side is working has no reason to avoid demonstrating it. Reluctance usually means either that they are not certain, or that something would surface which they would rather raise with you privately first.

When both are right

This happens frequently, and it is progress rather than a dead end. If both sides can evidence correct behaviour, the fault sits at the boundary, in something neither is looking at.

The usual causes are unglamorous and all have the same shape: an assumption about the interface that nobody wrote down.

One side expects a field that the other sends only sometimes. One treats a timeout as a definite failure while the other treats it as still pending. One retries after no response, and the other processes the retry as a second transaction. Character encoding differs, and it surfaces only on names with Arabic characters. A value means one thing in one system and something adjacent in the other.

None of these is a defect in either system considered alone. That is precisely why each supplier can honestly report that their side is fine, and why the problem can persist for months.

Where boundaries hide

Integrations are where this is most visible, and the pattern appears anywhere responsibility is split across two contracts.

A website that is slow, with a hosting provider, a development agency and a content team. The host shows healthy server response times. The developer shows efficient code. The content team uploaded the images they were asked to upload. Everyone is right, and the page takes eleven seconds.

An app that crashes, with one team on the mobile front end and another on the backend API. The front end handles every documented response correctly. The backend returns valid responses to every documented request. The crash happens on a response shape that was never documented.

A reporting dashboard that shows the wrong revenue figure, drawing from an accounting system and an ecommerce platform maintained by different people. Each system is internally consistent. They disagree about when a refund is recognised, and nobody owns the definition.

The common structure is always the same. Two parties, each correct within their own scope, and a fault sitting in an area that appears in neither scope of work. The number of suppliers is not the variable that matters. The number of unowned boundaries is.

Which suggests the wrong response and the right one. Consolidating to a single supplier does reduce boundaries, and it also concentrates risk and reduces specialist depth, so it is a genuine trade rather than an improvement. The better move is to keep the suppliers you need and make sure every boundary between them has somebody's name against it.

Somebody has to own the space between

Once you know the fault is at the boundary, the question stops being who is to blame and becomes who owns it going forward.

It matters much less who than that the choice is explicit and funded. Usually the right answer is whichever supplier built the integration, or whichever has the broader view of the whole system. What does not work is leaving it unassigned and relying on goodwill, because goodwill is abundant when things are easy and runs out precisely when a problem becomes difficult.

Where several suppliers touch one system, consider nominating a technical lead with responsibility for the whole picture, including other people's parts. Make it a paid role. It is genuine work, and an unpaid coordination responsibility gets performed badly by whoever has the least ability to decline it.

Most businesses pay nothing for coordination and expect it anyway. If you are not funding it, you are doing it yourself, and it is worth allocating your own time honestly rather than being surprised by how much of it this consumes.

What the standoff is costing while it runs

Rarely counted, and usually larger than the fix.

Both suppliers are billing for investigation time, in parallel, on the same problem. Your own people are spending days coordinating rather than doing their jobs. And the fault continues for customers throughout, which on a checkout or a booking flow is direct lost revenue rather than an inconvenience.

Put a rough number on it early, because it changes how the decision looks. A checkout failing for one customer in twenty, on a business taking a few hundred orders a month, is a meaningful revenue line. Set that against the cost of simply paying somebody to own the boundary and fix it regardless of fault, and the argument about attribution starts to look expensive in itself.

This is the practical case for separating two questions that get merged. Who fixes it now, and who pays for it afterwards. They do not have to be answered in that order, or in the same conversation. Agreeing that one supplier will fix it this week, with the commercial question parked explicitly for later, unblocks more standoffs than any amount of arguing about logs.

Most suppliers will accept that framing when it is offered clearly, because it lets them help without conceding liability. Very few will propose it themselves, because proposing it can look like an admission.

What does not transfer

There is a limit to how much of this you can push onto suppliers, and it is worth understanding rather than resenting.

The UK's National Cyber Security Centre makes the point directly in a security context: an organisation that relies on third parties, including outsourced or cloud-based services, remains accountable for the protection of its essential functions regardless of whether it or a third party operates them [1][2].

The same logic holds commercially. Your customers hold you responsible for a checkout that does not work. They have no relationship with your payment provider and no interest in your contractual arrangements. Whatever you recover from a supplier afterwards, the accountability to the customer was always yours.

That is not an argument for doing everything yourself. It is an argument for treating the coordination as your job to arrange, rather than as something that ought to happen without anyone arranging it.

The four clauses that prevent it

NCSC's supply chain guidance organises its twelve principles into four stages: understand the risks, establish control, check your arrangements, and continuous improvement [1]. The middle two are where this problem is either prevented or created, and in commercial software terms they come down to what your contracts say.

Four things, none exotic, almost never present:

Name the other suppliers. A contract that does not acknowledge the other systems it must work with cannot allocate responsibility for the interfaces between them.

Define whose responsibility the interface is. Explicitly, by name.

State what happens when a fault cannot be attributed. Who leads the investigation, who pays for the investigation time, and what the process is when both parties evidence correct behaviour.

Require cooperation. That each supplier will participate in joint investigation of faults affecting the shared system, provide logs and evidence within a stated time, and not withhold cooperation pending any commercial dispute. That final clause matters more than it looks, because a commercial disagreement is exactly the moment cooperation stops and exactly the moment you need it.

Add one practical permission alongside them: a written statement from you that suppliers may share diagnostic information with each other for fault investigation. Suppliers frequently withhold logs because nobody authorised sharing them and they are being appropriately careful. That obstacle is usually not contractual at all, merely unaddressed.

If your contracts are already signed, you can get some of this at renewal or through a short side agreement covering cooperation and escalation only. You will get less than you want and considerably more than you have. It is far easier to agree while nothing is broken.

Ask the question at procurement

The cheapest version of this whole article is one question asked before signing: who owns the interface between this and the systems it has to talk to?

Then ask each candidate how they handle a fault they believe sits on somebody else's side. The answers vary enormously and are highly predictive.

A good answer is specific and slightly unenthusiastic. We investigate first and establish what we sent and received. We join a call with the other party. We keep going until it is attributed, including when it turns out not to be ours.

A supplier who says faults get resolved amicably has not thought about it. One who immediately describes the boundary as somebody else's problem has told you their default position, which is useful and free.

Then, before going live, test the failure paths rather than only the working one. What happens when the other system is slow, returns an error, or is unavailable entirely? Most integration disputes concern behaviour under failure, because normal conditions were the only ones anybody exercised before launch. Our guide on system and API integration covers the technical side of that properly.

And write the boundary down: what is exchanged, in what format, what each field means, what happens on each kind of failure, and the expected timings. Have both suppliers confirm it in writing. It is a modest document, and it converts a whole category of dispute into a checkable question, because there is now a shared statement that somebody is demonstrably not matching.

When to bring somebody in

Do not let a standoff run for months. If two rounds of relayed messages have not resolved it, a third will not either. Escalate to a joint session with evidence within a week or two, and if that does not settle it, bring in an independent view.

Neither supplier can be neutral about whose fault it is, and that is not a criticism of either. An independent technical review can look at both sides of the boundary without a commercial interest in the answer. Tell your suppliers openly that you are doing it and why, because surprising people with an auditor rarely improves their willingness to help.

We do that work, and it starts from around AED 4,000. Final pricing depends on scope, and that is our own figure rather than a market rate.

Before spending anything, though, run the joint session. Put both suppliers on one call this week and ask each to walk through a single named failing transaction, showing what they sent and what they received. Refuse summaries. That one hour resolves a large share of these standoffs outright, and reveals the real boundary problem in most of the rest.

References

  1. National Cyber Security Centre, principles of supply chain security
  2. National Cyber Security Centre, Cyber Assessment Framework, principle A4 supply chain
  3. National Cyber Security Centre, supplier assurance questions
  4. SKIMBOX, system and API integration in Dubai
  5. SKIMBOX, how to read a software proposal
  6. SKIMBOX, how to check a software supplier before you sign

NCSC guidance is written for UK organisations and addresses supply chain security specifically. It is cited here for the accountability principle, which applies broadly, rather than as a rule governing commercial software contracts in the UAE.

Frequently asked questions

  • Why do suppliers blame each other instead of fixing things?

    Usually because each of them can see only their own side of the boundary and each is genuinely correct about it. Your agency can demonstrate that it sent a valid request. The payment provider can demonstrate that it responded correctly to what it received. Both statements can be true while the customer still cannot check out, because the fault lives in the space between the two systems, which neither of them is contracted to examine, monitor or own. Nobody assigned it, so nobody is looking at it.

  • Is somebody lying to me?

    Rarely, and assuming so makes the situation worse rather than better. Each supplier is looking at their own logs, which show their own behaviour, and reaching an honest conclusion from incomplete information. Treating it as bad faith puts both parties on the defensive and makes them less willing to share the detail that would actually resolve it. Each of them can see only up to their own edge. Treat it as a visibility problem first, and you get cooperation instead of defensiveness.

  • Who is responsible when an integration fails?

    Whoever your contract says, which in most cases is nobody, because the contracts were signed separately and neither mentions the other supplier. That gap is not an accident of bad drafting so much as the normal outcome of buying two things at two different times. That gap is the normal outcome of buying two things at two different times rather than a drafting failure. The practical answer is that you are responsible, because the accountability was never assigned to anybody else.

  • How do I break the standoff quickly?

    Get both suppliers into the same conversation at the same time, and insist on evidence rather than assertion. Ask each to show the request they sent and the response they received, with timestamps, for one specific failing transaction. Two accounts of the same event placed side by side usually resolve within an hour what weeks of relayed messages could not, because either one account is wrong or both are right and the boundary is the problem.

  • Why does relaying messages between suppliers not work?

    Because you are acting as a translation layer between two technical teams while understanding neither side fully, and detail gets lost at every hop. Each round trip takes a day, and each supplier answers the question they think you asked. Getting both parties in one room removes the translation layer entirely, along with the delay it introduces and the detail it loses. It is the single highest-value hour available to you.

  • What if a supplier refuses to join a call with the other?

    Treat that as information and say so plainly. A supplier confident that their side is working has no reason to avoid demonstrating it to a technical audience. Reluctance usually means either that they are less certain than they sounded, or that the conversation would surface something they would rather raise with you privately first. Either possibility is worth knowing about early.

  • What evidence should I ask for?

    One specific failing case, identified by a timestamp or a reference number, traced end to end. What was sent, what was received, what was returned, and what the receiving system did with it. Vague statements about things working on their side are not evidence. A request and response pair for one named transaction is evidence, and it is very hard to argue with. Refuse summaries and ask for the actual exchange.

  • What if both suppliers produce evidence that they are right?

    Then you have located the problem, which is progress. The fault sits at the boundary, in something neither is examining: a timeout, an encoding difference, a field that means one thing to one system and something else to the other, a retry that arrives twice. Somebody now has to own the space between the two systems, and deciding who is the next thing to settle. That is a commercial conversation rather than a technical one.

  • Who should own the boundary?

    Somebody, named, and it matters less who than that the choice is explicit and paid for. Usually it is whichever supplier built the integration, or whichever has the broader view of the system. What does not work is leaving the boundary unassigned and relying on goodwill, because goodwill is plentiful when things are easy and runs out precisely when a problem becomes difficult and expensive.

  • Should I appoint one supplier as the lead?

    Where you have several suppliers on one system, yes, and it should be a paid role rather than an assumed one. Nominating a technical lead with responsibility for the whole picture, including other people's parts, gives you a single point of accountability. Expect to pay for the role, because it is genuine work, and expect the arrangement to fail quietly if you do not. Unpaid coordination gets performed badly by whoever is least able to refuse it.

  • Does accountability transfer to my suppliers?

    Not entirely, and this is worth understanding rather than resenting. UK national cyber security guidance makes the point directly in a security context: an organisation relying on third parties remains accountable for the protection of its essential functions regardless of who operates them. The same logic holds commercially. Your customers hold you responsible for a checkout that does not work, and they have no relationship with your payment provider and no interest in your contracts.

  • What should the contract say to prevent this?

    Name the other suppliers, define whose responsibility the interface between them is, and state what happens when a fault cannot be attributed. Also state who leads investigation and what cooperation each party owes the other. Four clauses, none of them exotic or expensive to draft, and almost never present, because each contract was written as though it were the only agreement you had.

  • How do I add this to existing contracts?

    At renewal, or through a short side agreement all parties sign that covers cooperation and escalation only. You will get less than you want and more than you have. All of it is far easier to agree while nothing is currently broken, which is precisely why it is worth raising during a calm period rather than in the middle of an incident when positions have hardened.

  • What is a reasonable cooperation clause?

    That each supplier will participate in joint investigation of faults affecting the shared system, provide relevant logs and evidence on request within a stated time, and not withhold cooperation pending resolution of any commercial dispute. That final clause matters more than it appears, because a commercial disagreement is exactly the moment cooperation tends to stop and exactly the moment you most need it to continue.

  • Should one supplier be able to see the other's work?

    To the extent needed to investigate faults, yes, and it needs saying explicitly and in writing from you. Suppliers frequently cannot share logs or access because nobody authorised it and they are being careful. A written statement from you authorising them to share diagnostic information with each other for fault investigation removes an obstacle that everybody assumes is contractual when it is simply unaddressed.

  • What if the fault is genuinely nobody's?

    It happens more often than people expect, particularly with third-party services outside everyone's control. Somebody still has to fix it, so the question becomes commercial rather than moral: who is best placed, what will it cost, and who pays. Argue about the commercial question instead of about fault, because the fault question can genuinely have no answer while the question of who fixes it always does.

  • How much should I be paying for this coordination?

    Something, and most businesses pay nothing and expect it anyway. Coordination between suppliers is real work that somebody performs, and if it is not funded it gets done badly by whoever has the least ability to refuse. Either pay a lead supplier to do it properly, or accept that you are doing it yourself and allocate your own time honestly rather than being surprised by how much it consumes.

  • Can I do the coordination myself?

    You can if you have someone with enough technical understanding to tell a real answer from a plausible one. Without that, you become a message relay, which adds delay without adding judgement. If nobody internally can play that role, buy it from a lead supplier or buy it independently. What does not work is leaving the position empty and assuming somebody will step into it.

  • Should I bring in an independent third party?

    It is worth considering when the standoff has persisted, because neither supplier can be neutral about whose fault it is. An independent technical review can look at both sides without a commercial interest in the answer. Tell your suppliers openly that you are doing it and why, because surprising people with an auditor rarely improves anybody's willingness to help, and you still need them afterwards.

  • How long should I let a standoff run?

    Not more than a week or two before changing the process rather than repeating it. If two rounds of relayed messages have not produced a resolution, a third will not either. Escalate to a joint session with evidence, and if that does not settle it, bring in an independent view. The failure mode in these situations is almost always excessive patience rather than haste.

  • Does this only happen with integrations?

    Integrations are where it is most visible, and it happens anywhere responsibility is split. A site that is slow, with a separate hosting provider, developer and content team. An app that crashes, with one team on the front end and another on the backend. Any boundary between two contracts is a place where a fault can sit unclaimed indefinitely, with everybody involved behaving entirely reasonably throughout.

  • Is using fewer suppliers the answer?

    Sometimes, and it is a real trade rather than an obvious improvement. One supplier means one point of accountability and less coordination, and it also means more concentration risk and less specialist depth. The better framing is not to minimise the number of suppliers but to make sure every boundary between them has somebody's name written against it in a contract.

  • How do I avoid this on a new project?

    Ask at procurement, before signing anything, who owns the interface between this and the systems it must talk to. Ask each candidate supplier how they handle a fault they believe is on somebody else's side. The answers vary enormously between suppliers and are highly predictive of what actually happens later, and it is a question almost no buyer thinks to ask before signing.

  • What does a good answer to that question sound like?

    Specific and unenthusiastic. We investigate first and establish what we sent and received, we join a call with the other party, and we keep going until it is attributed even where it turns out not to be ours. A supplier who says faults are always resolved amicably has not thought about it. One who immediately describes the boundary as somebody else's has told you their default.

  • Should I test the integration before going live?

    Thoroughly, and specifically test the failure paths rather than only the one where everything works. Most launches exercise the happy path exclusively. What happens when the other system is slow, returns an error, or is unavailable entirely? Most integration disputes concern behaviour under failure rather than under normal conditions, precisely because normal conditions were the only ones anybody exercised before launch.

  • What is the most common technical cause?

    Assumptions about the boundary that were never written down. One side expects a field that the other sends only sometimes. One treats a timeout as a failure while the other treats it as pending. One retries and the other processes the retry as a second transaction. None of these is a bug in either system considered alone, which is exactly why each supplier can honestly report that their side is fine.

  • How do I document the boundary properly?

    Write down what is exchanged, in what format, what each field means, what happens on each kind of failure, and what the expected timings are. Then have both suppliers confirm it in writing. It is a modest document and it turns a category of dispute into a checkable question, because now there is a shared statement somebody is demonstrably not matching.

  • Does this cost me money even when it gets fixed?

    Almost always, and the cost is rarely counted properly. Both suppliers bill for investigation time in parallel on the same problem, your own people spend days coordinating instead of working, and the fault persists for customers throughout. That total is usually considerably larger than what it would have cost to assign the boundary properly at the outset, which is the whole argument for assigning it at the outset.

  • Can you help resolve a standoff?

    We can act as the independent technical view, which means looking at both sides of the boundary without a commercial interest in the answer and telling you plainly where the fault sits. That starts from around AED 4,000 with us and produces a written finding both suppliers can see. Final pricing depends on scope, and these are our own figures rather than a market survey.

  • What should I do today if I am in one?

    Put both suppliers on one call this week and ask each to walk through a single named failing transaction, showing what they sent and what they received. Do not accept summaries. That one session, with actual evidence in front of everybody at once, resolves a large share of these standoffs outright and reveals the genuine boundary problem in most of the rest.

SKIMBOX Team

Tech Consultancy

Get fresh writing in your inbox

One email a fortnight. No filler.

By subscribing, you agree to our privacy policy.

Want us to build something?

We work with teams across MENA, UK, USA, and India to build products, run programs, and grow.

Get in touch

Continue reading