Reputational Risk from Suppliers and Partners: When Your Name Is on the Line

Why a business's reputation depends on its partners

Small businesses rarely work alone. They buy materials, hire subcontractors, sell through dealers, and have their website managed by an agency. Each of these partners acts in their name to some extent. When one of them breaks the rules, customers do not first ask who signed the contract. They ask whom they bought from.

This article therefore asks: When is the misconduct of a supplier or partner attributed to your own business, and how can an owner limit this risk? To answer it, we first clarify the terms and the thinking model of attribution theory, look at a documented case and experimental findings, weigh two views on control, and finally derive a tool for ranking partners by their reputational risk.

Reputational risk, liability, and attribution: the terms

A reputational risk is the danger that the trust of customers, employees, banks, or the public in a business declines, with consequences for sales, recruitment, or financing. With reputational risks from partners, the trigger does not lie within your own business, but with a supplier, subcontractor, dealer, or service provider.

The difference between liability and attribution is important. Liability is a legal question: who has to answer for damage? Attribution is a question of perception: whom do people blame? The two often diverge. A carpentry business is not liable for its timber supplier processing illegally logged wood. If a customer finds out, they will still ask why the business bought from this supplier of all suppliers.

Reputation in a crisis shows how reputational damage spills over to bystanders, using the 2015 emissions scandal: according to an estimate by Bachmann and colleagues (2023), US sales of other German carmakers fell by an estimated 34.6 percent because of the image damage. If even competitors of the same origin share the blame, this applies all the more to business partners.

The thinking model: attribution theory

Attribution theory from social psychology describes how people explain why something happened and to whom they assign responsibility. In the version shaped by Bernard Weiner, observers examine three dimensions: the locus of the cause, meaning whether it lies inside or outside the accused organization; controllability, meaning whether the organization could have prevented the fault; and intentionality, meaning whether it was knowingly accepted. The more internal, controllable, and intentional a fault appears, the more blame is assigned.

For suppliers, this means that a fault at the partner is initially external and reduces your own business's blame. But this relief melts away as soon as customers get the impression that the business could have known or prevented it, or that it deliberately looked away because the partner was cheaper.

An everyday analogy: if a babysitter leaves a child unsupervised, we first see the fault with the babysitter. But if it turns out that the parents knew he had done this before and hired him anyway because he was cheap, the reproach turns to the parents. The fault has not changed, but what is known about their control and intent has.

Customers forgive a business for its supplier's fault more readily than for the looking away that made it possible.

A documented case: Rana Plaza 2013

On April 24, 2013, the Rana Plaza factory building collapsed in Bangladesh; several textile factories in it produced for international fashion brands. More than 1,100 people died. Labels of well-known brands were found in the rubble. Several retailers admitted to having produced there; others denied involvement or spoke of unauthorized production by subcontractors.

Legally, the brands were mostly not owners of the factories and had no direct employment contracts with the workers. In public perception, this hardly mattered. On May 15, 2013, unions and initially around 40 brands and retailers signed a binding accord on fire and building safety in Bangladesh that provided for independent inspections. The case is regarded as one of the triggers for supply chain due diligence laws, which today reach even small suppliers through their customers. Supply chain act and EU directive describes what of this reaches small businesses after the latest reforms.

For a small business, the scale is different. But the lesson is the same: the distinction between your own business and the supplier, which is clear in the contract, blurs in the public's judgment as soon as the damage is large and the connection becomes visible.

What experiments show about blame in supply chains

Pizzetti, Gatti, and Seele (2021) tested attribution theory for environmental promises in supply chains. In three experiments with 107, 202, and 158 participants from the US, conducted between October 2017 and January 2019, participants assessed a fictitious food company whose claims and reality diverged. The authors distinguished three forms of greenwashing: direct, when the company itself violates its claims; indirect, when a supplier violates its own sustainability claims; and vicarious, when a supplier violates the claims of the company buying from it.

• Locus matters. Direct greenwashing led to the highest blame attribution, indirect to the lowest. In willingness to invest in the company, however, direct and vicarious greenwashing did not differ. Anyone who advertises with promises that their supplier breaks is punished almost as if they had broken them themselves.
• Claimed control raises the stakes. When the company had declared that it controlled its supply chain, blame increased and willingness to invest fell, even if the violation lay with the supplier.
• Intent sharpens the judgment. When participants had the impression that the company had acted intentionally, they assigned it more blame, even for violations in the supply chain.

The study has limitations that the authors name: fictitious scenarios, participants from an online platform, one company from the food industry. Mukandwal, Cantor, and Laczniak (2024) reached a fitting result in two experiments: consumers rated products as more environmentally harmful when a company knowingly sourced from irresponsible suppliers and put profit above responsible sourcing. As a response, mandatory measures toward suppliers worked, while voluntary ones did not.

How media and distance amplify the risk

Whether a fault at a partner becomes known at all depends heavily on media coverage. Kach, Pournader, and Ho (2026) analyzed 52,781 media reports on sustainability incidents at suppliers of companies in the US S&P 500 stock index from 2007 to 2021. They show that the media pick up new and repeated incidents differently depending on severity and novelty, and that the institutional distance between buyer and supplier, meaning differences in legal systems and norms, influences how much attention an incident receives.

Two conclusions matter for small businesses. Repeated incidents at the same partner are more dangerous than a single one, because they create the impression of looking away. Marques, Morais, and Terra (2025) describe how such looking away arises, in a project with 18 organizations in the Brazilian fashion industry: buying firms justified unfair purchasing practices by shifting responsibility to consumers who were unwilling to pay more or to suppliers who did not behave as expected. And partners in countries with very different rules deserve more attention, because more can happen there and because incidents there receive more attention. For many small businesses, however, the greater risk comes from close by: from subcontractors who work at the customer's site and from sales partners who appear under the business's name.

Two views: promise control or disclose limits?

The first view says: a business should check its partners carefully and communicate this too. Customers expect responsibility for the supply chain, and anyone who promises nothing appears indifferent. This is supported by the requirements of large customers, who demand declarations from suppliers, and by the finding of Mukandwal and colleagues that mandatory measures win back trust.

The second view warns: anyone who publicly claims control raises their own stakes. According to Pizzetti and colleagues, blame rises precisely when a company has declared that it has its supply chain under control. A small business cannot know every supplier of its suppliers anyway.

I consider a third stance, derived from both, to be the most sustainable: check what you can check, and say exactly that, no more. Instead of “Our entire supply chain is fair,” say “We have visited our ten most important suppliers or checked their evidence; from the others we require a written declaration.” That is less glossy but verifiable, and it holds in an emergency. Greenwashing describes how to check environmental claims for evidence in advance, and Deny, justify, deflect how to communicate in a crisis.

The reputation chain: ranking partners by reputational risk

From attribution theory I derive a tool that I call the reputation chain. It ranks all important partners by how likely their misconduct is to fall back on your own business. A spreadsheet is enough.

1. List partners

   Write down all suppliers, subcontractors, sales partners, and service providers you work with regularly.

2. Rate visibility

   Rate from 1 to 3 how visible the connection is to your customers. A subcontractor on site at the customer is a 3, a supplier of screws a 1.

3. Rate damage potential

   Rate from 1 to 3 how serious a possible incident would be: safety, working conditions, environment, data protection, quality at the customer.

4. Check your own promises

   Rate from 1 to 3 whether you make public commitments about this partner or its area, for example on your website, in offers, or in a supplier declaration to your customers.

5. Set the depth of checking

   Multiply the three values. From 12 points, a thorough check with a conversation and evidence is appropriate; below that, a basic check is enough.

In this worked example, the timber supplier ends up in the thorough check because the business advertises timber from sustainable forestry on its website. This is exactly the case of vicarious greenwashing: your own promise turns the supplier into a risk. Due diligence on business partners describes how a basic check using public registers works in around 20 minutes and what a thorough one looks like. Evaluating suppliers adds how to rate suppliers continuously on quality and cooperation.

Conclusion: your reputation shares the liability when control is claimed or looking away becomes visible

To the guiding question: a partner's misconduct is attributed to a business above all when the connection is visible, when the business has made its own promises that the partner breaks, and when the impression arises that it could have known or prevented it. Attribution theory explains this logic, experiments confirm it for supply chains, and the Rana Plaza case shows how little contractual boundaries count in the public's judgment when the damage is large.

For a small business, this implies no duty to scrutinize every stage of its supply chain, but a duty to be honest about what it checks. If you know your riskiest partners, check them thoroughly, and only promise what you can prove, you limit the risk where it arises.

• Record and rate all regular partners in a reputation chain.
• Check partners with 12 points or more thoroughly, with a conversation and evidence.
• Check public statements on supply chain, environment, and labor for verifiability.
• Decide in advance who informs and who decides when an incident occurs at a partner.