VENDOR MANAGEMENT

PROGRAM TEMPLATE

VENDOR MANAGEMENT PROGRAM Company name Street Address City, State 00000 Web Address Version 0.0.0 00/00/0000

VERSION HISTORY
VERSION	APPROVED BY	REVISION DATE	DESCRIPTION OF CHANGE	AUTHOR

PREPARED BY	TITLE	DATE
APPROVED BY	TITLE	DATE

Table of Contents

1.	VENDOR MANAGEMENT PROGRAM OVERVIEW & PURPOSE	3

2.	OVERSIGHT	4

3.	POLICIES & PROGRAM RESPONSIBILITY	5

4.	VENDOR RANKINGS	6

5.	VENDOR RISK MANAGEMENT & MITIGATION	7

6.	DUE DILIGENCE & REQUIRED DOCUMENTATION	9

7.	VENDOR SELECTION	11

8.	CONTRACTING	12

9.	LEGAL REVIEW, CONFIDENTIALITY & NONDISCLOSURE	13

10.	MONITORING	15

11.	REPORTING	16

12.	DISCIPLINARY ACTION & TERMINATION	17

VENDOR MANAGEMENT PROGRAM OVERVIEW & PURPOSE

ABC Insurers, Inc. generates business results by cultivating mutually beneficial partnerships and striving to continuously improve every aspect of our business. In support of such goals, our vendor relationship management mitigates risks, controls costs, and collaborates, so our company can achieve more significant competitive advantages. PURPOSE ABC Insurers, Inc. relies on a diverse group of vendors to deliver services, products, and systems. Such vendors include consulting, software, and hardware contractors, IT and telecommunication services, marketing firms, and support staff. Our vendor managers safeguard the company by focusing on the following key elements: Business and Strategy: Each vendor selection supports our overall business requirements and strategic plans. Expertise: Our internal managers must have the expertise to manage and oversee our various vendor relationships. Functionality: We evaluate potential vendors according to the following criteria: scope, criticality, and quality. Risk Management: We apply rigorous standards to identifying and assessing the associated risks of any vendor engagement. Monitoring: An ongoing oversight program monitors contractual performance and risk mitigation activities.

OVERSIGHT

The vendor management office (VMO) assigns each of its staff members to oversee the vendor performance of specific vendors or types of vendors. The VMO uses the following tactics to assess whether or not vendors fulfill their contractual obligations: Determine: Calculate the cost of product(s) or service(s) that our company requires. Identify: Identify the potential vendors that meet the strategic goals and objectives of our company. Vet: Evaluate the vendors to make sure they possess the capabilities and service experience we need. Negotiate: Conduct negotiations to obtain the best price. Manage: Engage in ongoing risk and performance management, including enforcing schedules. Mitigate: Minimize our potential exposure to risk. Research: Perform due diligence regarding each of our vendors by evaluating the following: a firm’s financial reputation, current financial condition, business relationships, and past performance. Verify: Confirm the experience and expertise of each vendor’s principals. Confirm: Make sure that we have confidence in each vendor. Foster: Cultivate ongoing relationships with our vendors. Review: Review the performance, pricing, financial status, and goal attainment of each vendor on an ongoing basis.

POLICIES & PROGRAM RESPONSIBILITY

ABC Insurers, Inc. requires vendor managers to use the policies that govern our vendor relationships in order to negotiate or execute vendor contracts. These policies include the following: Enforceability: The VMO at ABC Insurers, Inc. is responsible for policy enforcement. Conflict Resolution: The vendor oversight committee resolves conflicts, or perceived conflicts, with any of our particular policies. The VMO treats all other policies as secondary to this conflict resolution policy unless the VMO itself grants an exception/exemption. Regulatory Review: Vendors are subject to regulatory review that is consistently determined by the VMO. Exceptions/ Exemptions: Vendors that are not high priority or that don’t pose substantial risks to our company may not be subject to every aspect of company policy concerning documentation and legal reviews. If a vendor wishes to seek an exemption from or exception to this policy, it must submit that request in writing.

VENDOR RANKINGS

Classifying vendors by criticality is essential to oversight and vendor risk management. The VMO’s oversight and review activities concentrate most heavily on level-one vendors. Vendor Rankings: Strategic: This ranking typically represents about 6-10 vendors. By collaborating with us to innovate processes, products, and services, strategic vendors are instrumental to our profitability and growth. Preferred: These vendors provide services that are vital to our business. Whether a vendor provides products or services, the VMO specialist responsible for such vendor must closely monitor the vendor relationship. Tactical: These vendor contracts have minimal impact on our company and may be short-term agreements; however, if the engagement length with a particular vendor is, in fact, brief, this vendor may also prove to be a high-spend partner. Commodity: This type of vendor is easy to replace and not critical to our operations, service levels, and customer service.

VENDOR RISK MANAGEMENT & MITIGATION

ABC Insurers, Inc. makes risk management a priority in all of its vendor relationships. Failure to mitigate and prevent these risks can result in significant financial loss, reputational damage, and legal/regulatory issues. The VMO assesses and oversees risk factors, enforces mitigation, and manages vendors regarding the following: Compliance Risk: These are risks associated with operational and information security policies, procedures, and processes. Vendors must meet compliance laws and regulations. Country Risk: Risks arising from the political, economic, and social landscape within a foreign country can impact vendor services and our company operations. Environmental, Social, and Governance Risk: These are risks related to climate change impacts, environmental practices, working and safety conditions, human rights, and compliance with laws and regulations. Financial Risk: These include any financial risks based on the vendor's condition. Operational Risk: These are risks that arise when a system of internal operational controls fails. Reasons for this type of failure can include the inadequacy/inefficiency of people, processes, or methods. Reputation Risk: These are risks related to data breaches, unethical business practices, or other actions that have generated negative public perception and opinion. Strategic Risk: These are risks that arise from the failure to achieve planned business objectives, initiatives, or goals. Technology Risk: These are risks that arise from any number of information technology/governance security issues, including inadequate resources (hardware, software, or workforce).

RISK MITIGATION CONTROLS VMO: The VMO identifies, assesses, and mitigates risk and implements controls based on our company framework. Corporate Departments: Specialists regularly review risk management, information/data security, and regulatory or legal compliance to assist in supporting vendor risk management. These specialists monitor and perform other activities to confirm compliance with internal policies/external regulations. Internal Audit: The VMO provides our board of directors and executive management team with reports that assess various aspects of the vendor management process; such aspects include the design and operating effectiveness of risk management activities and internal controls.

DUE DILIGENCE & REQUIRED DOCUMENTATION

The documents that vendors must submit for consideration may vary. XYZ Document Services collects and stores requisitioned documents as part of our due diligence reviews and onboarding process. Requests for resubmittal and updates are part of ongoing due diligence. Some of the required documents include, but are not limited to, the following: Qualifications and Company Background: These include a vendor's business history and market share for a given service. These documents may also include the qualifications and backgrounds of the vendor’s principals and, when appropriate, criminal background checks. Ownership and Licenses: These include contact and background information as well as business and patent licenses. Tax Forms: These include completed IRS and accounting forms. Financial Reports: We require banking, investment, and income statements, including audited financial documentation. Assessment of Information Security for Information Technology Control: This includes the verification of a vendor’s application standards, such as SOC reporting. Information Security: We require detailed descriptions and the verification of data protection. Risk Management and Assessment Plans: A vendor must submit documentation that describes the controls it has in place to lower risk. Such documentation includes ongoing assessments and plans. Business Continuity Plan: These documents articulate the details of a vendor’s business continuity plan. Such details include how the vendor plans to support your institution in the event of a disaster or outage. The program may be part of an SOC 2 report.

Incident Response Plan: This document describes a vendor’s methods for preventing, detecting, or recovering from cyber or internet-based incidents. This plan may be part of an SOC 2 report. Insurance Coverage: This document states that a vendor’s coverage is adequate to cover any losses that you may incur due to a failure on the vendor's part. Subcontractor Controls: These include the review plans and processes that govern the performance, quality, compliance, and insurance of a vendor’s subcontractors.

VENDOR SELECTION

Strategic sourcing maximizes vendor relationships, reduces costs, streamlines procurement, and ensures compliance. When considering level-one or level-two vendors that require long-term agreements and significant resources, ABC also assesses whether these potential partners make a good match culturally. Vendor selection begins with three phases: Procurement: New vendors are part of a competitive bid process that includes a minimum of three sources. Planning: Our VMO develops requirements for qualified vendors based on the products or services we are purchasing. These specialists clarify performance expectations and identify, assess, and manage risk. The VMO also ensures that the product or service of every potential vendor includes the provision of any technical expertise that we may require to complete procurement and onboarding. Solicitation: Solicitation is the process of notifying qualified vendors that ABC wants to receive bids or proposals regarding specific products or services. Solicitation comes in the form of a request for quote (RFQ), request for proposal (RFP), or request for Information (RFI). (The RFI helps facilitate the creation of the RFQ/RFP.) Details vary, but a vendor’s proposal should address the objectives, scope of work, service levels, key performance indicators, delivery timelines, change controls, financial penalties, fee schedule, and selection criteria. After the VMO follows these steps to determine whether or not a vendor is qualified, the department performs due diligence and risk assessment and develops a contract.

CONTRACTING

ABC uses a DCE Contract Management cloud-based system to house and track all its written agreements, including security surveys and due diligence documentation. Contract activities include the following: Contract: A contract between ABC Insurers, Inc. and a vendor specifies all the relevant terms, conditions, responsibilities, and liabilities of both parties. When the VMO finishes the contract, it submits the document to the legal team. Counsel then reviews the contract to make sure that its terms and conditions are appropriate and comply with company policy. Contract Administration: All contracts reside in the DCE Contract Management system and are accessible only to those with a business need. The system maintains the contracts in the central document repository in order to meet regulatory compliance and document preservation requirements. Expiration, Modification, and Renewal: The cloud-based system flags contracts for review when they are due to expire in 60 days or when they are reaching the minimum notice period to amend, modify, extend, or renew an original agreement. It is the responsibility of the VMO to complete any risk assessment or due diligence before granting a renewal. Termination: Termination occurs when a vendor’s contract expires, when a vendor satisfies the terms of its contract, or when a vendor defaults on a contract.

LEGAL REVIEW, CONFIDENTIALITY & NONDISCLOSURE

ABC Insurers, Inc.'s legal counsel reviews all contracts. Vendor contracts address the following: Scope: The contract covers the specifics of the arrangement with the vendor, the products or services that the vendor offers, and the vendor activities that our company authorizes. Responsibilities of All Parties: The contract communicates the obligations of ABC Insurers, Inc., the vendor, and their subcontractors. Service-Level Agreement (SLA): The SLA is a list of expectations and obligations. The VMO attaches it to the document that addresses performance standards and measures. Reporting: The contract includes our requirements regarding the vendor’s performance reports and the frequency of those reports. Ownership: The contract describes the nature of the vendor’s control, maintenance, and access to any of our financial and operating records; the document also outlines the nature of any ownership regarding servicing rights. Confidentiality and Nondisclosure: The contract states that the vendor must maintain strict confidence and must not share any aspect of the relationship without permission. Audits: This portion of the contract covers the rights and requirements of both parties, including the responsibility for payment of the vendor, guaranteed by the contract. In order to conduct a vendor audit, the VMO evaluates the following areas: the overall feasibility of the vendor; the competence and responsibilities of its management team; and the data integrity of its systems. The main objectives of a vendor audit are to assess the organization's overall quality management by evaluating that entity’s various procedures and data processes. Business Resumption or Contingency Planning: The contract states that the vendor needs to conform to our business continuity and contingency plans.

Insurance Coverage: This part of the contract enumerates the types and prices of insurance coverage that the vendor needs to fulfill contract obligations. Customer Complaints and Customer Service: This clause states that it is the responsibility of the vendor to address and resolve all service issues. Compliance with Regulatory Requirements: This clause specifies which regulations the vendor must meet. Penalties: This clause describes the financial penalties that result from any performance failures. Dispute Resolution: This clause covers how ABC and its vendors handle differences. Parties can agree to arbitration or mediation. Default, Termination, and Escape Clauses: This clause covers in detail how either party can end the contract.

MONITORING

The vendor management of ABC Insurers, Inc. requires ongoing monitoring of vendor spend, performance, and risk. The VMO regularly reviews vendor activities in the following areas: Spend: Our specialists review the following spending data categories: total spend by vendors; total spend on vendors; spend by vendor type; and other spend analyses. The VMO also reviews data-driven reports. Performance: Collaborating with business area managers, the VMO develops a performance audit program to assess vendor compliance with service-level and quality-of-service agreements. The scope, frequency, and documentation of such a performance review can vary according to vendor, but the audit usually addresses oversight, service level, quality agreements, contract terms, billings, and disbursements. Risk: The VMO continuously monitors for risk factors and behaviors based on country, environmental circumstances, social and governance issues, financial status, operational functions, reputation, and strategic and technology practices.

REPORTING

The VMO provides reports on vendor risks, performance, and spend-monitoring activities. There are four different types of reports: On-Demand Reports: These are ad hoc reports prompted by fraud or compliance concerns. Executive Committee Reviews: These are group-level quarterly, yearly, and ad hoc reports that the executive committee receives. Oversight Committee Reports: The oversight committee receives these reports on all board-of-director and executive committees. The oversight committee also receives monthly accounting, risk, and performance reports. Technology Reviews: IT vendor reviews and reports require expertise. The CIO or their designated managers conduct these assessments.

DISCIPLINARY ACTION & TERMINATION

ABC Insurers, Inc. and it's VMO monitor vendors to supervise performance and compliance. If a vendor fails to follow contracted procedures, appropriate actions ensue. If the VMO decides to pursue a dispute and/or disciplinary action, it follows the process steps outlined below: Oral Reprimand: After documenting the problem or issue and having a face-to-face or virtual meeting, the designated VMO manager and subject vendor discuss poor performance or other issues to determine if there was a violation of contract terms. Written Reprimand: If poor performance or other issues persist, the VMO submits a written notice to the vendor detailing the problem and potential solution; the specialist also conducts a second face-to-face or virtual meeting. The VMO provides a time frame for resolution. Arbitration: Disputes are subject to arbitration. We include such a remedy in our contracts. Both parties must agree upon the selection of arbitrator/arbitrators. Termination: If the vendor cannot comply with the contract terms after oral and written reprimands, the VMO terminates the relationship by giving proper notice and adhering to the steps outlined in the vendor contract. Reinstatement: A vendor whose contract has been terminated due to unacceptable performance may apply for reinstatement via vetting, due diligence, and the other standards set by the VMO.

DISCLAIMER Any articles, templates, or information provided by Smartsheet on the website are for reference only. While we strive to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability, or availability with respect to the website or the information, articles, templates, or related graphics contained on the website. Any reliance you place on such information is therefore strictly at your own risk.