Vendor management has been around for years. Having a firm grasp on the companies with whom you are doing business is not new, but the regulatory expectations continue to evolve and grow.
Whether you’re dealing with the very basic supplier or the most cutting-edge high-tech company, there are certain things you should discern about every vendor.
The Core Elements
The basics of vendor management are well-explained in regulatory guidance (e.g., FDIC FIL 44-2008, FIL 3-2012; OCC Bulletin 29-2013), but to summarize some of the guiding principles, let’s review… a well-managed and functioning program should include at least these 5 core elements:
1. Due Diligence Standards
Know the company with whom you are doing business. Determine their good standing and licensing to conduct business. Learn about their reputation and gather documents to show they are a well-managed and compliant operation.
2. Assess the risk
As you gather the various due diligence documents, start looking for gaps or areas that may cause concern. Use a rating system to be objective and consistent. Where you identify risks, determine what you can do to address and minimize exposure.
3. Ongoing Monitoring
How will you manage this vendor going forward? Are there performance metrics that will require regular reporting? Is there some sort of quality of service you need to measure?
4. Contract Standardization
Be sure that the vendor has certain obligations, such as notifying you of a breach or changes in ownership. Make sure each party’s roles and responsibilities to one another are clearly defined.
5. Board Involvement
Senior management and the board of directors must be kept informed of the status of your vendor management program. Inform, seek guidance and approval when needed.