# The third-party landscape for distributors

> Map of the outside businesses a wholesale distributor relies on, what data each touches, what breaks when it fails, typical contracts and what to ask.

Source: https://docs.lumina-erp.com/first-and-third-parties/the-third-party-landscape-for-distributors/

**In short.** A wholesale distributor can rely on 27 kinds of outside business, from suppliers and carriers to tax engines, banks and IT providers. This map groups them and shows what data each one touches and what stops when it fails, so you can see which relationships deserve the most attention.

A wholesale distributor buys, stocks, sells and ships other companies' products, so it depends on outside businesses at every step. This map lists 27 kinds of third party. Most distributors use the majority of them, and few have them written down in one place. The tables below group them by what each type of provider does for you, with the data each one touches, what breaks when it fails and the usual contract. The questions worth asking follow each table. Use it to build your own inventory and to decide where to spend attention first.

## The map at a glance

| Group | Provider types | You cannot |
|---|---|---|
| Supply side | Suppliers and manufacturers, manufacturer reps, buying groups and co-ops | Get product, or get it at a competitive cost |
| Logistics | 3PLs, carriers, freight brokers, customs brokers | Receive, store or deliver product |
| Trading and channels | EDI providers and VANs, e-commerce platforms and marketplaces, PIM and content syndication, iPaaS | Take orders electronically or show accurate product data |
| Money | Tax engines, payment processors and gateways, banks and lockbox, factoring and credit insurance, credit bureaus | Invoice correctly, collect cash or extend credit safely |
| Technology | ERP publisher, ERP partner or VAR, ISV add-ons, MSP and IT, cloud hosting, cybersecurity | Run the system everything else depends on |
| People and assurance | Auditors, outsourced accounting, payroll and PEO, insurance brokers, staffing agencies | Close the books, pay people, stay insured or staff the warehouse |

Examples below use invented businesses and round numbers.

## Supply side

| Provider | What they do | Data they touch | If they fail | Typical contract |
|---|---|---|---|---|
| Suppliers and manufacturers | Make or source the products you resell | Your purchase orders, forecasts, sell-through and rebate claims, sometimes customer names on special pricing | Stockouts, backorders, lost rebate and special pricing income | Distribution or line agreement, price files, rebate program terms, return and stock rotation policy |
| Manufacturer reps | Independent sales agencies that sell a manufacturer's line to distributors and end users | Your quotes, project pipeline, special pricing requests | Lost specification work and project pricing | Contract is with the manufacturer, not with you |
| Buying groups and co-ops | Pool member purchasing for better terms, rebates and programs | Your purchase volumes by supplier, sometimes sales data | Loss of group pricing and rebates, late rebate payments | Membership agreement, fees or rebate share, program rules |

Questions to ask each type of provider:

- Suppliers and manufacturers: What are the territory, return and price-protection terms? How do rebates and special pricing claims work? What notice do you give on price changes or discontinuation?
- Manufacturer reps: Which lines do you represent, and do any compete? Who owns the project registration?
- Buying groups and co-ops: How are rebates calculated and when are they paid? What purchase data do you share and with whom? How do you leave?

A mid-sized electrical distributor (invented) might buy through 400 suppliers, but 20 of them account for most of its purchases. Those 20 deserve the same attention you give your ERP vendor. See [vendor rebates and special pricing](/distribution/vendor-rebates-and-special-pricing/) for the money that rides on these relationships.

## Logistics

| Provider | What they do | Data they touch | If they fail | Typical contract |
|---|---|---|---|---|
| Third-party logistics (3PL) | Warehousing, pick, pack and ship on your behalf, sometimes kitting and returns | Inventory, orders, customer ship-to addresses, sometimes pricing on packing lists | You cannot ship from that location, inventory records drift | Warehousing agreement with rate sheet (storage, handling, pick fees), service levels, liability limits per pound or per unit |
| Carriers (parcel, LTL, truckload) | Move goods | Ship-to addresses, weights, contents, sometimes declared value | Late or missed deliveries, damage claims | Tariff and rate agreement, accessorial charges, claims rules |
| Freight brokers | Arrange transport with carriers they do not own | Shipment details, addresses, rates | A load with no truck, or a carrier you did not vet | Broker-shipper agreement. In the U.S., brokers of property register with FMCSA under 49 CFR Part 371 |
| Customs brokers | File entries and clear imports with customs | Commercial invoices, classifications, values, importer of record number | Goods held at the port, penalties for wrong classification | Power of attorney and service agreement. U.S. customs brokers are licensed by CBP |

Questions to ask each type of provider:

- Third-party logistics (3PL): How do inventory counts reconcile with our ERP? What is your liability per unit if you lose stock? How do we get our inventory out at the end?
- Carriers (parcel, LTL, truckload): What are the fuel and accessorial surcharges? How are claims filed and within what time limit?
- Freight brokers: Are you registered and bonded as a broker? How do you vet carriers? Who is liable for cargo loss?
- Customs brokers: Who is the licensed broker on our account? How do you classify new items? What is our exposure if an entry is wrong?

The [logistics providers and 3PLs page](/first-and-third-parties/logistics-providers-and-3pls/) goes deeper, and [landed cost and freight terms](/distribution/landed-cost-and-freight-terms/) covers what freight does to your cost.

## Trading and channels

| Provider | What they do | Data they touch | If they fail | Typical contract |
|---|---|---|---|---|
| EDI providers and VANs | Translate and move electronic documents such as purchase orders, advance ship notices and invoices, usually in ANSI X12 formats | Orders, invoices, pricing, ship notices with trading partners | Large customers' orders stop arriving, chargebacks for late or wrong documents | Subscription plus per-document or per-kilocharacter fees, per-partner setup fees |
| E-commerce platforms and marketplaces | Run your web store, or sell your products on a third-party marketplace | Customers, orders, pricing, inventory availability, sometimes payment data | Online orders stop, wrong prices or stock shown | SaaS subscription, or marketplace seller agreement with commission |
| PIM and content syndication | Collect, clean and distribute product data and images from manufacturers | Item master, attributes, images, sometimes pricing | Wrong or missing product data online, returns from customers who ordered the wrong item | Subscription by SKU count or by channel, content licensing terms |
| iPaaS (integration platforms) | Connect the ERP to other systems through hosted integration flows | Whatever passes through: orders, customers, items, invoices | Every integration on the platform stops at once | Subscription by connections, flows or transactions |

Questions to ask each type of provider:

- EDI providers and VANs: What does each new trading partner cost to set up? How are failed documents reported to us? How fast can we move our maps elsewhere?
- E-commerce platforms and marketplaces: Who owns the customer data? How often does inventory and price sync with the ERP? What are marketplace fees and delisting rules?
- PIM and content syndication: Who licenses the manufacturer content, and can we keep using it if we leave? How current is the data?
- iPaaS (integration platforms): Where are the flows hosted? Who is alerted when a flow fails? Can we export the flow definitions?

See [EDI for distributors](/distribution/edi-for-distributors/) and, for the selling side, [selling through others](/first-and-third-parties/selling-through-others/).

## Money

| Provider | What they do | Data they touch | If they fail | Typical contract |
|---|---|---|---|---|
| Tax engines | Calculate sales and use tax by jurisdiction, manage exemption certificates, sometimes file returns | Ship-to addresses, item tax codes, customer exemptions, invoice totals | Wrong tax on invoices, audit exposure, blocked invoicing if the service is down | Subscription by transaction volume, filing fees. Some states pay certified service providers under the Streamlined Sales Tax agreement |
| Payment processors and gateways | Authorize and settle card and ACH payments | Card data or tokens, bank details, customer names, amounts | Cannot take card payments, delayed deposits | Merchant agreement, rate schedule (interchange plus or tiered), PCI DSS obligations, ACH under Nacha rules |
| Banks and lockbox | Hold cash, process deposits, receive customer remittances | Bank accounts, customer payments and remittance detail | Cash application stops, missed payroll or supplier payments | Deposit and treasury services agreements, fee analysis |
| Factoring and credit insurance | Buy receivables for cash, or insure against customer non-payment | Customer list, AR aging, credit limits, invoices | Lost cash flow, uninsured bad debt, customers told to pay a third party | Factoring agreement with advance rate and fees, or credit insurance policy with named buyer limits |
| Credit bureaus | Provide business credit reports and scores | Customer names and identifiers, sometimes your own payment experience with customers | Credit decisions made blind or on stale data | Subscription or per-report pricing, data use restrictions |

Questions to ask each type of provider:

- Tax engines: What happens to invoicing if your service is unreachable? Who is liable for a calculation error? How do we get our exemption certificates out?
- Payment processors and gateways: What is our effective rate? Who holds card data, and what is our PCI scope? What reserves or holds can you place on funds?
- Banks and lockbox: How is remittance data delivered to us, and in what format? What are the cut-off times? What fraud controls apply to outgoing payments?
- Factoring and credit insurance: Recourse or non-recourse? What do customers see? What happens if you cut a customer's limit?
- Credit bureaus: What may we do with the reports? Do you want our trade payment data in return?

:::caution[Not legal advice]
Payment, lending and customer data carry legal and card-network obligations that depend on what you do. For example, the FTC Safeguards Rule (16 CFR Part 314) requires the businesses it covers to oversee their service providers, and whether it covers you depends on your activities. Check your obligations with counsel.
:::

See [sales tax for distributors](/distribution/sales-tax-for-distributors/) and [credit card fees and surcharges](/distribution/credit-card-fees-and-surcharges/).

## Technology

| Provider | What they do | Data they touch | If they fail | Typical contract |
|---|---|---|---|---|
| ERP publisher | Builds and supports the core ERP software | All of it, directly if SaaS or hosted, through support sessions if on premises | Everything. Releases, fixes and support stop, or the hosted system is down | License or subscription agreement, maintenance and support terms |
| ERP partner or VAR | Implements, configures, supports and sometimes resells the ERP | All of it during projects and support | Stalled projects, no help on configuration, lost knowledge of how your system was set up | Statement of work, time and materials or fixed fee, sometimes a support retainer |
| ISV add-ons | Extend the ERP for things it does not do natively | Whatever the add-on handles: warehouse scans, pricing, documents, CRM | That function stops, and it may block an ERP upgrade | Subscription or license with maintenance |
| MSP and IT support | Run your network, servers, desktops, backups and help desk | Administrative access to nearly everything | Outages, failed backups, a compromised admin account reaching every system | Managed services agreement with monthly fee per user or device, SLAs |
| Cloud hosting | Run servers or platforms in data centers | Your full database and files | The system is down, or data is lost if backups are not separate | Online terms or enterprise agreement, shared responsibility model |
| Cybersecurity providers | Monitoring, endpoint protection, email filtering, testing | Logs, alerts, often privileged access | Attacks go unnoticed, or a security tool itself becomes an outage | Subscription, incident response retainer |

Questions to ask each type of provider:

- ERP publisher: What is the support lifecycle of our version? What are the uptime commitments if hosted? How do we get a full data export?
- ERP partner or VAR: Who exactly is on our account? Who owns the work product? How is our configuration documented?
- ISV add-ons: Which ERP versions do you certify, and how fast after a release? Where is our data hosted?
- MSP and IT support: How do you protect your own admin access to our systems? When did you last test a restore of our backups?
- Cloud hosting: Which security tasks remain ours? Where are backups, and who can delete them?
- Cybersecurity providers: Who responds at 2 a.m. and what can they do without asking us? What reports do we get?

See [ERP add-ons and ISVs](/first-and-third-parties/erp-add-ons-and-isvs/) and [implementation partners and consultants](/first-and-third-parties/implementation-partners-and-consultants/).

:::note[Disclosure]
Lumina ERP is an ERP consultancy, one of the provider types in this table. The questions above are the ones we think you should ask any partner, including us.
:::

## People and assurance

| Provider | What they do | Data they touch | If they fail | Typical contract |
|---|---|---|---|---|
| Auditors and CPAs | Audit or review financial statements, tax filings, advisory | General ledger, inventory, AR, contracts | Late financial statements, bank covenant problems | Engagement letter |
| Outsourced accounting | Bookkeeping, AP, AR, close, sometimes controller services | Financial data, bank access, supplier and customer records | Late close, missed payments, weak segregation of duties | Monthly service agreement |
| Payroll providers and PEOs | Run payroll and tax filings, or co-employ staff and provide benefits | Employee personal data, pay rates, bank accounts | People are not paid, tax penalties | Service agreement, or PEO client service agreement. The IRS runs a voluntary certification program for PEOs |
| Insurance brokers | Place property, liability, cyber, cargo and credit insurance | Financials, loss history, security controls | Gaps in cover discovered after a loss | Broker of record letter, commission or fee |
| Staffing agencies | Supply temporary warehouse, driver or office staff | Worker details, sometimes system logins for temps | Short-staffed warehouse in peak, safety incidents | Staffing agreement with bill rates, conversion fees |

Questions to ask each type of provider:

- Auditors and CPAs: What will you need from our ERP, and when? What did last year's findings say about system controls?
- Outsourced accounting: Who approves payments, and who can release them? What access do your staff have to our bank?
- Payroll providers and PEOs: Are you an IRS-certified PEO? Who is liable for payroll tax if you fail to remit?
- Insurance brokers: What third-party and cyber risks are excluded? What do insurers require of our vendors?
- Staffing agencies: Who is the employer of record for safety and workers' compensation? How are system logins for temps created and removed?

## How to use this map

- [ ] **Build your own list.** One row per provider you use, with the owner inside your business and the contract renewal date.
- [ ] **Mark the data.** Note which providers hold customer, employee, bank or card data. They go first in any security review.
- [ ] **Mark the single points of failure.** Any provider whose outage would stop shipping or invoicing within a day.
- [ ] **Look for shared dependencies.** If three providers run on the same cloud or the same MSP, one failure is three failures. See [fourth parties and concentration risk](/first-and-third-parties/fourth-parties-and-concentration-risk/).
- [ ] **Ask for assurance reports where they exist.** Many technology and financial providers can share a SOC 1 or SOC 2 report under the AICPA framework.
- [ ] **Set a review cycle.** Critical providers every year, the rest at renewal.

## Red flags across every group

- No one inside the business can name the owner of a provider relationship.
- A provider holds bank, card or employee data and you have never seen their security terms.
- Contracts that auto-renew with no notice window you track.
- A provider that cannot tell you where your data is hosted.
- Your MSP or ERP partner has standing admin access with no record of who uses it.

## Which providers to review first

Start with the providers that would stop shipping or invoicing within 24 hours if they failed. For most distributors that is the ERP and its host, the MSP, the main carriers, the EDI provider, the payment processor and the bank. Put those six through the [vendor due diligence checklist](/first-and-third-parties/vendor-due-diligence-checklist/) first, then work outward.

## Sources

- [49 CFR Part 371, Brokers of Property (eCFR)](https://www.ecfr.gov/current/title-49/subtitle-B/chapter-III/subchapter-B/part-371)
- [Customs Brokers (U.S. Customs and Border Protection)](https://www.cbp.gov/trade/programs-administration/customs-brokers)
- [X12 (the standards body for ANSI X12 EDI)](https://x12.org/)
- [Streamlined Sales Tax Governing Board](https://www.streamlinedsalestax.org/)
- [PCI Security Standards Council](https://www.pcisecuritystandards.org/)
- [Nacha (ACH Network rules)](https://www.nacha.org/)
- [Certified Professional Employer Organization (Internal Revenue Service)](https://www.irs.gov/tax-professionals/certified-professional-employer-organization)
- [FTC Safeguards Rule, 16 CFR Part 314 (eCFR)](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314)
- [AICPA and CIMA, SOC 2 and system and organization controls](https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2)

---

Epicor, Prophet 21, P21 and DynaChange are trademarks or registered trademarks of Epicor Software Corporation registered in the United States and other countries. Kinetic is a trademark of Epicor Software Corporation. Lumina ERP is an independent consultancy and is not affiliated with, sponsored by or endorsed by Epicor.