Ending the Contract Doesn’t End the Risk

This is Article 3 of the Connected or Exposed series, which examines why public sector organisations struggle to answer compound operational questions.

Governments know what their contractors cost. But do they know what their contractors carry?  The institutional knowledge, relationships, and capabilities that migrate out of the department at some point and are never recovered?

That gap is what makes contractor workforce dependency different from most procurement risks. The exposure isn't visible until someone tries to, or has to exit.

Different governments discovered this in different ways. None of them knew in advance what the discovery would cost.

A government services contractor holding hundreds of public sector contracts including hospitals, prisons, schools, and armed forces, collapsed on a Monday, less than a decade ago. No insolvency firm would take the administrator role; the High Court appointed an Official Receiver instead. The government was still seeking information from schools and local authorities when liquidation was declared. The emergency cost to the taxpayer came to more than a hundred million. 

A year later, the same dependency trapped a second major contractor with over 40,000 employees and public contracts spanning hospitals, prisons and probation services. The only viable path was a pre-arranged rescue, creditors converting debt to equity to keep the contracts running. Not a managed exit but a managed continuation.

The government recognised the pattern. New frameworks were introduced, officials trained, guidance published. One-third of the government spending still sits with private contractors today. Knowing you have a dependency is not the same as being able to exit it.

The other case is different. No collapse, no scandal. Just a policy decision to cut what looked like redundant capacity. Tens of thousands of positions were removed from a large federal government, characterised in many cases as replaceable. Agencies discovered which characterisations were accurate by watching functions fail. Some are being hired back. Contractor dependency, already structural, deepened as organic capacity contracted.

All cases share a structure. The dependency cycle runs the same way: an organisation outsources a function for cost, speed, or specialist access. The internal team alongside the contractors gradually stops doing the work. Institutional knowledge migrates into contractor staff, contractor relationships, contractor systems. When the dependency eventually has to end - by choice, by collapse, or by policy directive - the organisation finds it cannot absorb the work back without disruption. It can preserve the dependency or pay the exit cost. There is rarely a third option.

What’s missing is the insight that would make this problem visible in time: 

• Here is the share of this programme's operational capacity that now sits in a contractor workforce rather than our own people.
• This is what breaks, and the downstream impact, if that workforce exits. 

It surfaces only when someone tries to end the relationship and by then, the answer takes longer to assemble than the situation allows.

The pace has changed

Those cases unfolded over roughly a decade. In each, the dependency built slowly enough that someone could have caught it. That pace is no longer the operating assumption.

Three forces are now converging, each compressing an already narrow window.

The first is at the workforce level. The same governments, now structurally dependent on contractors, are simultaneously cutting the organic capacity that would execute a managed reabsorption. Agencies that discovered their "replaceable" classifications were wrong did so by watching functions fail, not by modelling the dependency in advance. That outcome emerged due to the prior erosion of internal capability: the people who could have taken the work back were already gone. This pattern of a government appearing to reduce contractor dependency by cutting government workers while actually deepening it, is not unique to any one administration. It is the structural consequence of any headcount reduction that targets operating capacity without first mapping what each departure actually breaks.

The second force is the inverse: rapid scaling of defence procurement. The only mechanism to deploy that volume of expenditure at that speed is contractors. New dependencies are being written now, before the dependencies from the previous spending cycle have been mapped or understood. The cases that become the next decade's case studies are being created today.

The third force sits in the ownership chain. Corporate structures are being reorganised under trade pressure, sanctions regimes, and defence-sector M&A, at a pace procurement that cycles were not designed to track. A contractor organisation cleared at contract award eighteen months ago is not necessarily the same entity today: same brand, different ownership structure three steps up, reorganised under the new trade environment. The exit window was always short, but today, it’s narrowing from all three sides at once.

The ownership chain no one traced

There's a compounding dimension that contractor headcount alone doesn't capture at all.

A firm supplying advisory staff to a defence programme may itself sit inside an ownership structure you'd never have sanctioned direct access to. A prime contractor subcontracts the actual work to a smaller firm; that firm was acquired eighteen months ago; the acquirer has investors that, three steps up the chain, trace back to an entity you'd recognise as a problem- if you had traversed the chain. Most governments haven't.

This is the policy problem now being addressed by regulation rather than by practice. The EU's revised Foreign Direct Investment Screening Regulation, provisionally agreed in December 2025, specifically closes the intermediary loophole and targets ownership and investment structures. Who controls the people supplying critical public functions is the next layer down.

The workforce dependency question and the ownership question are the same question, separated by a number of relationships.

The traversal your procurement system can't do

A government that wants to answer "what is the operational impact if we lose this contractor tomorrow?" is asking a graph question.

The answer requires traversal: which programmes does this firm service, which roles within those programmes lack organic coverage, which of those are mission-critical, what adjacent capacity could absorb the load without creating new gaps elsewhere, who owns this firm, who owns them, and does anything in that chain represent an exposure you've already decided you don't accept?

Every step crosses a system boundary. The HR records don't reflect the actual scope of contractor work. The contract file shows the expiry date; nothing shows what expires with it: the institutional knowledge, the relationships, the capabilities that never transferred back. The procurement system doesn't know what the programme management system knows. And AI applied to that fragmented landscape will likely answer the question incorrectly, because the relationships it needs to reason over don't exist in any single system. It is missing a knowledge layer.

A connected data model – one that maps contractors, subcontractors, ownership chains, programmes, roles, and dependency relationships as a linked structure — makes the traversal possible before the crisis. It turns "what’s impacted if this contractor exits?" from a question you answer retrospectively into one you can answer now. But only if the model reflects the current state. An ownership chain mapped when the contract was awarded and not revisited since is not a connected model. It is a historical document. Given the pace at which those chains are moving, that distinction matters.

The gap between the decision to exit a contractor dependency and the ability to understand what that exit will actually break is what this article is about.

Connected organisations can traverse it. Exposed ones find out the answer when the contractor is already gone.

Right now, with internal capacity contracting, new dependencies accumulating, and ownership chains reshuffling faster than any procurement review cycle, the question isn't whether that moment is coming. It's whether the answer will be ready when it does.