Dont know BP specifically, but in no normal big corporation can 'some low level engineer' just go and create accounts at will unless said provider is already used quite a bit. There are approved providers, getting stuff from them goes through responsible team which should ask many relevant questions.