Mapping the chain: the people, systems and third parties every football club actually depends on
A single Premier League matchday can involve well over a thousand people who are not employed by the club at all. Stewarding, catering, cleaning, ticketing technology and much of the infrastructure that makes a fixture happen sits with a small number of specialist operators serving much of the league at once. Mapping exposes exactly how concentrated that dependency really is, and when most clubs do this exercise properly for the first time, they find they are surprised by what they find.
This article is the fourth in our series on Operational Resilience for Football clubs. You can find other articles in this series here.
Why mapping is where the real exposure gets found
The first two disciplines in this series -- identifying important business services and setting impact tolerances for each -- are largely internal exercises. A club can complete both of them, in theory, without leaving the boardroom. Mapping is different. It is the point at which the resilience programme has to go and look, in specific and sometimes uncomfortable detail, at who and what actually stands behind each important business service on the day it is needed.
The FCA's own supervisory experience under PS21/3 is instructive here, and it applies with very little modification to football. Financial services firms that had confidently identified their important business services and set defensible tolerances were, in a meaningful number of cases, found to have mapped only their own internal systems -- and to have significant, poorly understood gaps in their mapping of the third-party suppliers those internal systems actually depended on. The FCA's position was blunt: outsourcing the delivery of a service does not outsource the responsibility for its resilience. If a critical supplier fails, the harm still lands on the organisation's own customers, and the regulator holds the organisation accountable regardless of where the failure actually originated.
Football clubs are, if anything, more exposed to this dynamic than most financial services firms, because the outsourcing of matchday operations specifically is not the exception in English football. It is the standard model.
Outsourcing the delivery of a service does not outsource the responsibility for its resilience. If a critical supplier fails, the harm still lands on the club's own supporters.
What mapping actually means
Mapping, in the operational resilience sense, means identifying -- specifically, not generally -- the people, processes, technology, facilities and third parties that a given important business service depends on to function. The output is not a narrative description. It is closer to an inventory: for the service in question, who are the named individuals whose absence would be a problem, which specific systems does it run on, which physical locations does it require, and which external suppliers sit in the chain, doing what, with what alternative available if they fail.
Done properly, mapping surfaces two kinds of risk that a purely internal review will not find. The first is single points of failure -- a specific individual, system or supplier that a service depends on entirely, with no fallback. The second, and the one this article focuses on, is concentration risk -- where a club's dependency on a third party is not unique to that club at all, but shared across a large proportion of the league, meaning a single supplier failure has the potential to disrupt matchday operations at many clubs simultaneously.
A worked example: mapping matchday operations
Take the important business service identified in the second article of this series: safe matchday operations. Mapped properly, the dependency chain behind a single Premier League fixture looks considerably more complex, and considerably more externally dependent, than most boards assume.
Stewarding and crowd management. A Premier League matchday typically requires somewhere in the region of 600 to 1,000 stewarding and security staff -- a workforce delivered almost entirely by specialist operators rather than club employees. Showsec is the largest single operator in this market, alongside a small number of regional stewarding companies. This is not a criticism of any individual club's arrangements; it reflects the structure of the industry as a whole. It does mean, however, that a significant operational or financial disruption at one of the handful of companies that dominate this market is not a single-club risk. It is a risk shared across a meaningful proportion of the league at once.
Catering and hospitality. The catering and hospitality workforce on a Premier League matchday is typically the largest single category of staff on site -- often 600 to 1,500 people across bars, kiosks, lounges and executive dining. This function is run at the large majority of major UK stadiums by one of four national operators: Levy UK, Sodexo Live!, Delaware North UK or Aramark UK. Again, this reflects a genuinely concentrated market, not an unusual arrangement at any single club. A club that has mapped its catering dependency will know precisely which of these operators it relies on, what continuity provisions exist in that contract, and what the fallback looks like if that operator experiences a serious disruption of its own -- a question with genuine relevance given how many other stadiums, across multiple sports and clubs, the same operator is very likely also serving on the same weekend.
Cleaning and facilities management. A further 100 to 300 staff typically deliver pre- and post-match cleaning and building maintenance, commonly through national facilities management contractors such as OCS Group or Mitie, or through a local specialist. This workforce is smaller than stewarding or catering, but its failure has a direct bearing on whether a venue can be safely and lawfully opened for the following fixture, which makes it a genuine dependency for the matchday service even though it operates largely out of public view.
Ticketing and access-control technology. The digital ticketing platforms that underpin modern matchday access control are themselves a concentrated market. UEFA's own ticketing technology, for example, is delivered by SecuTix under a contract renewed through to 2029, while Ticketmaster Sport holds ticketing partnerships with a wide range of English clubs across multiple divisions. A club that has mapped this dependency understands not just which platform it uses, but what that platform's own resilience posture is, what happens if the platform experiences an outage during the pre-match entry window discussed in the previous article, and whether a fully resourced manual fallback process actually exists and has been tested -- rather than assumed.
Policing and emergency services. Unlike the categories above, policing sits outside any commercial contract the club controls, which makes it a different category of dependency entirely -- one the club can plan around and coordinate with, but cannot resource, substitute or contractually guarantee. Mapping should capture this distinction explicitly: a dependency the club can influence through contract terms and service levels is a different kind of risk to one the club can only plan around and communicate with.
What the mapping exercise reveals: concentration risk
Look at the picture that emerges once matchday operations are mapped properly, and a pattern becomes visible that is easy to miss when each supplier relationship is considered in isolation. The Premier League\'s own figures put stadium attendance at over 15 million visits across 380 matches in a single season -- and a very large proportion of the workforce and technology delivering that experience, across nearly every club in the division, runs through a genuinely small number of specialist operators: a handful of stewarding companies, four national catering operators, two or three national facilities management contractors, and a small number of ticketing technology platforms.
This is concentration risk in its clearest form. It is not a flaw in any individual club\'s procurement decisions -- using an established, specialist national operator is, in most cases, the sensible commercial choice. But it does mean that a serious disruption at one of these operators -- a major cyber incident, an insolvency, a significant regulatory or safety failure -- has the structural potential to affect matchday operations at multiple clubs simultaneously, on the same weekend, in a way that a club assessing only its own individual risk position would never see coming.
The questions mapping should answer for every important business service
The matchday example above illustrates the method, which applies equally to every other important business service a club has identified -- player registration processing, payroll, broadcast delivery, data protection and financial reporting all have their own dependency chains, and most of them include at least one third party the club has never formally assessed for resilience.
Who, specifically, delivers this service, and is that a named individual, a named team, or a named third-party organisation?
If a third party, what proportion of the wider market does that same supplier also serve, and what does that tell us about how exposed the sector as a whole is to a single failure at that supplier?
Is there a genuine, tested fallback if this specific dependency fails, or is the fallback assumed rather than evidenced?
Does the club's contract with this supplier contain any resilience or continuity obligations at all, or does it govern price and service quality without addressing what happens under serious disruption?
Third-party mapping is a governance exercise, not a procurement one
It is worth being precise about where ownership of this exercise should sit. Third-party and supplier relationships are typically managed at an operational or procurement level, and the instinct is to treat mapping as an extension of that existing relationship management. That instinct under-scopes the exercise. The question mapping asks -- what happens to our important business service if this supplier fails -- is a resilience and governance question, not a commercial one, and it needs to be owned at the same senior level as the important business service itself.
The next article in this series builds directly on this mapping work: how to design and run scenario testing that actually stresses these dependencies against severe but plausible disruption, rather than assuming that a mapped dependency is automatically a resilient one.
Most clubs have never seen their own dependency chain mapped in full and the gaps are usually where the third parties sit.
Lagom Sports Compliance works with football clubs across governance, risk, compliance and operational resilience. If your club has not yet mapped the people, systems and third parties its most critical services depend on, we would welcome a conversation about what that process looks like for your club.
Frequently asked questions: mapping dependencies and third-party risk in football
-
Mapping means specifically identifying the people, processes, technology, facilities and third parties that a given important business service depends on to function, rather than describing that dependency in general terms. The output is closer to an inventory than a narrative: for each critical service, who are the named individuals whose absence would be a problem, which specific systems does it rely on, which physical locations does it require, and which external suppliers are involved, with what alternative available if any one of them fails.
-
Stewarding and matchday security across Premier League football is delivered by a small number of specialist operators rather than club employees, with Showsec the largest single operator in this market alongside a limited number of regional stewarding companies. A typical Premier League matchday requires in the region of 600 to 1,000 stewarding and security staff, most of whom are engaged through these external operators rather than employed directly by the club.
-
Matchday catering and hospitality at the majority of major UK football stadiums is delivered by one of four national operators: Levy UK, Sodexo Live!, Delaware North UK or Aramark UK. This is typically the largest single category of matchday workforce, often involving 600 to 1,500 staff across bars, kiosks, hospitality lounges and executive dining for a single Premier League fixture.
-
Concentration risk arises when a club's dependency on a third-party supplier is not unique to that club, but shared across a significant proportion of the wider industry. In English football, matchday stewarding, catering and ticketing technology are all delivered by a genuinely small number of national operators serving much of the league simultaneously. A serious disruption -- such as a major cyber incident, an insolvency, or a significant regulatory failure -- at one of these operators therefore has the structural potential to affect operations at multiple clubs on the same weekend, a risk that is invisible if a club only assesses its own individual supplier relationships in isolation.
-
Procurement and supplier relationship management typically focus on cost, service quality and contractual terms. Dependency mapping in the operational resilience sense asks a different question -- what happens to a critical service if this specific supplier fails -- which is a resilience and risk question that needs board-level ownership at the same seniority as the important business service itself. Treating mapping purely as an extension of existing supplier management tends to under-scope the exercise, because it does not systematically test whether a genuine, evidenced fallback exists if the relationship fails.
-
No. Outsourcing the delivery of a service does not outsource the responsibility for its resilience. This principle, well established in UK financial services regulation under the FCA's PS21/3 framework, applies equally to football: if a critical outsourced supplier fails, the resulting harm still lands on the club's own supporters, players or staff, and the club remains accountable for having planned for that possibility, regardless of where the underlying failure originated.