Your checkout is failing for about one customer in twenty. Your web agency has looked at it and says the payment gateway is rejecting valid requests. The payment provider has looked at it and says they are responding correctly to what they receive.
Three weeks later, both are still right, the checkout is still failing, and you have spent a considerable amount of your own time carrying messages between two teams who have never spoken to each other.
The accountability gap was not created when the fault appeared. It was created the day you signed two contracts that did not mention each other.
Nobody is lying
This is worth establishing first, because the instinct is to assume somebody is covering something up, and that assumption makes the situation harder to resolve.
Each supplier is looking at their own logs. Those logs show their own system's behaviour, accurately. Your agency can demonstrate that a valid request left their server. The provider can demonstrate that they responded correctly to what arrived at theirs.
Both statements are true. The customer still cannot pay.
The fault lives in the space between the two systems, and neither supplier is contracted to examine that space, monitor it, or own it. It is not that they are refusing. It is that nobody ever assigned it, and each of them can see only up to their own edge.
Treating this as bad faith puts both parties on the defensive and makes them less willing to share the detail that would resolve it. Treat it as a visibility problem, because that is what it is.
Break the standoff with evidence
The single most effective move costs nothing and most people never make it: get both suppliers into the same conversation, at the same time, and insist on evidence rather than assertion.
Relaying messages does not work, and it is worth understanding why. You are acting as a translation layer between two technical teams while fully understanding neither. Detail gets lost at each hop. Each round trip takes a day. Each supplier answers the question they think you asked rather than the one the other party meant.
So: one call, both parties, and a specific ask.
Take one failing transaction, identified by a timestamp or reference number. Ask each side to show what they sent, what they received, and what they did with it. Not a summary. The actual request and response.
Two accounts of the same event, placed side by side, resolve within an hour what weeks of relayed messages could not. Either one account turns out to be wrong, in which case you have your answer, or both are correct, in which case you have located the problem precisely.
If a supplier resists joining that call, treat it as information and say so. A supplier confident that their side is working has no reason to avoid demonstrating it. Reluctance usually means either that they are not certain, or that something would surface which they would rather raise with you privately first.
When both are right
This happens frequently, and it is progress rather than a dead end. If both sides can evidence correct behaviour, the fault sits at the boundary, in something neither is looking at.
The usual causes are unglamorous and all have the same shape: an assumption about the interface that nobody wrote down.
One side expects a field that the other sends only sometimes. One treats a timeout as a definite failure while the other treats it as still pending. One retries after no response, and the other processes the retry as a second transaction. Character encoding differs, and it surfaces only on names with Arabic characters. A value means one thing in one system and something adjacent in the other.
None of these is a defect in either system considered alone. That is precisely why each supplier can honestly report that their side is fine, and why the problem can persist for months.
Where boundaries hide
Integrations are where this is most visible, and the pattern appears anywhere responsibility is split across two contracts.
A website that is slow, with a hosting provider, a development agency and a content team. The host shows healthy server response times. The developer shows efficient code. The content team uploaded the images they were asked to upload. Everyone is right, and the page takes eleven seconds.
An app that crashes, with one team on the mobile front end and another on the backend API. The front end handles every documented response correctly. The backend returns valid responses to every documented request. The crash happens on a response shape that was never documented.
A reporting dashboard that shows the wrong revenue figure, drawing from an accounting system and an ecommerce platform maintained by different people. Each system is internally consistent. They disagree about when a refund is recognised, and nobody owns the definition.
The common structure is always the same. Two parties, each correct within their own scope, and a fault sitting in an area that appears in neither scope of work. The number of suppliers is not the variable that matters. The number of unowned boundaries is.
Which suggests the wrong response and the right one. Consolidating to a single supplier does reduce boundaries, and it also concentrates risk and reduces specialist depth, so it is a genuine trade rather than an improvement. The better move is to keep the suppliers you need and make sure every boundary between them has somebody's name against it.
Somebody has to own the space between
Once you know the fault is at the boundary, the question stops being who is to blame and becomes who owns it going forward.
It matters much less who than that the choice is explicit and funded. Usually the right answer is whichever supplier built the integration, or whichever has the broader view of the whole system. What does not work is leaving it unassigned and relying on goodwill, because goodwill is abundant when things are easy and runs out precisely when a problem becomes difficult.
Where several suppliers touch one system, consider nominating a technical lead with responsibility for the whole picture, including other people's parts. Make it a paid role. It is genuine work, and an unpaid coordination responsibility gets performed badly by whoever has the least ability to decline it.
Most businesses pay nothing for coordination and expect it anyway. If you are not funding it, you are doing it yourself, and it is worth allocating your own time honestly rather than being surprised by how much of it this consumes.
What the standoff is costing while it runs
Rarely counted, and usually larger than the fix.
Both suppliers are billing for investigation time, in parallel, on the same problem. Your own people are spending days coordinating rather than doing their jobs. And the fault continues for customers throughout, which on a checkout or a booking flow is direct lost revenue rather than an inconvenience.
Put a rough number on it early, because it changes how the decision looks. A checkout failing for one customer in twenty, on a business taking a few hundred orders a month, is a meaningful revenue line. Set that against the cost of simply paying somebody to own the boundary and fix it regardless of fault, and the argument about attribution starts to look expensive in itself.
This is the practical case for separating two questions that get merged. Who fixes it now, and who pays for it afterwards. They do not have to be answered in that order, or in the same conversation. Agreeing that one supplier will fix it this week, with the commercial question parked explicitly for later, unblocks more standoffs than any amount of arguing about logs.
Most suppliers will accept that framing when it is offered clearly, because it lets them help without conceding liability. Very few will propose it themselves, because proposing it can look like an admission.
What does not transfer
There is a limit to how much of this you can push onto suppliers, and it is worth understanding rather than resenting.
The UK's National Cyber Security Centre makes the point directly in a security context: an organisation that relies on third parties, including outsourced or cloud-based services, remains accountable for the protection of its essential functions regardless of whether it or a third party operates them [1][2].
The same logic holds commercially. Your customers hold you responsible for a checkout that does not work. They have no relationship with your payment provider and no interest in your contractual arrangements. Whatever you recover from a supplier afterwards, the accountability to the customer was always yours.
That is not an argument for doing everything yourself. It is an argument for treating the coordination as your job to arrange, rather than as something that ought to happen without anyone arranging it.
The four clauses that prevent it
NCSC's supply chain guidance organises its twelve principles into four stages: understand the risks, establish control, check your arrangements, and continuous improvement [1]. The middle two are where this problem is either prevented or created, and in commercial software terms they come down to what your contracts say.
Four things, none exotic, almost never present:
Name the other suppliers. A contract that does not acknowledge the other systems it must work with cannot allocate responsibility for the interfaces between them.
Define whose responsibility the interface is. Explicitly, by name.
State what happens when a fault cannot be attributed. Who leads the investigation, who pays for the investigation time, and what the process is when both parties evidence correct behaviour.
Require cooperation. That each supplier will participate in joint investigation of faults affecting the shared system, provide logs and evidence within a stated time, and not withhold cooperation pending any commercial dispute. That final clause matters more than it looks, because a commercial disagreement is exactly the moment cooperation stops and exactly the moment you need it.
Add one practical permission alongside them: a written statement from you that suppliers may share diagnostic information with each other for fault investigation. Suppliers frequently withhold logs because nobody authorised sharing them and they are being appropriately careful. That obstacle is usually not contractual at all, merely unaddressed.
If your contracts are already signed, you can get some of this at renewal or through a short side agreement covering cooperation and escalation only. You will get less than you want and considerably more than you have. It is far easier to agree while nothing is broken.
Ask the question at procurement
The cheapest version of this whole article is one question asked before signing: who owns the interface between this and the systems it has to talk to?
Then ask each candidate how they handle a fault they believe sits on somebody else's side. The answers vary enormously and are highly predictive.
A good answer is specific and slightly unenthusiastic. We investigate first and establish what we sent and received. We join a call with the other party. We keep going until it is attributed, including when it turns out not to be ours.
A supplier who says faults get resolved amicably has not thought about it. One who immediately describes the boundary as somebody else's problem has told you their default position, which is useful and free.
Then, before going live, test the failure paths rather than only the working one. What happens when the other system is slow, returns an error, or is unavailable entirely? Most integration disputes concern behaviour under failure, because normal conditions were the only ones anybody exercised before launch. Our guide on system and API integration covers the technical side of that properly.
And write the boundary down: what is exchanged, in what format, what each field means, what happens on each kind of failure, and the expected timings. Have both suppliers confirm it in writing. It is a modest document, and it converts a whole category of dispute into a checkable question, because there is now a shared statement that somebody is demonstrably not matching.
When to bring somebody in
Do not let a standoff run for months. If two rounds of relayed messages have not resolved it, a third will not either. Escalate to a joint session with evidence within a week or two, and if that does not settle it, bring in an independent view.
Neither supplier can be neutral about whose fault it is, and that is not a criticism of either. An independent technical review can look at both sides of the boundary without a commercial interest in the answer. Tell your suppliers openly that you are doing it and why, because surprising people with an auditor rarely improves their willingness to help.
We do that work, and it starts from around AED 4,000. Final pricing depends on scope, and that is our own figure rather than a market rate.
Before spending anything, though, run the joint session. Put both suppliers on one call this week and ask each to walk through a single named failing transaction, showing what they sent and what they received. Refuse summaries. That one hour resolves a large share of these standoffs outright, and reveals the real boundary problem in most of the rest.
References
- National Cyber Security Centre, principles of supply chain security
- National Cyber Security Centre, Cyber Assessment Framework, principle A4 supply chain
- National Cyber Security Centre, supplier assurance questions
- SKIMBOX, system and API integration in Dubai
- SKIMBOX, how to read a software proposal
- SKIMBOX, how to check a software supplier before you sign
NCSC guidance is written for UK organisations and addresses supply chain security specifically. It is cited here for the accountability principle, which applies broadly, rather than as a rule governing commercial software contracts in the UAE.



