rated medium- and high-risk over a threshold spend of £an independent third-party audit before they are approved as a supplier and to agree to regular review audits as an existing supplier at least once every 24 months.