Vendor Oversight Checklist Template

Decide which vendors this review covers, who does each part and what each criticality tier is checked on, before anyone collects data. The questions in the first task add the tasks for a first review or a repeat review, and for a firm under outsourcing rules. Every due date counts in working days back from the meeting that receives the report.

• Set up the oversight review — the review period, the date of the meeting that receives the report, whether this is the first portfolio review, whether outsourcing rules apply to the organisation, and the people; later tasks are assigned from these fields
• Review the last oversight report and its open actions — a repeat review only: what the last review found, which actions were done, which are still open, and what the approver asked to see this time
• Confirm the scope and the review period — which vendors and outsourced services are in scope (every third party that provides a service, or those above a spend or risk threshold), the period reviewed and anything left out, with the reason
• Agree the criticality tiers and what each tier is reviewed on — what makes a vendor Critical, High, Medium or Low, and what each tier gets: critical vendors an SLA review, a meeting, current attestations and an exit plan; lower tiers lighter checks
• Collect the data the review needs — spend by vendor from accounts payable, the contract register, service reports, incident and complaint records, certificates and insurance documents already on file

Oversight starts with a complete list. Bring the vendor inventory up to date, check each vendor's tier against the agreed criteria, and record what the critical vendors hold or can reach and who they pass work to.

• Build the vendor list from payments and contracts — a first review only: every vendor paid or under contract in the last 12 months, from accounts payable, purchase orders, card spend and the contract register, so nothing is missed
• Update the vendor inventory — vendors added and ended since the last review, changes to the services they provide, the business owner of each, annual spend and contract end dates
• Confirm each vendor's criticality tier — re-tier any vendor whose service, data access, spend or importance has changed since it was last tiered, and record why
• Record what each critical vendor holds or can reach — personal and confidential data it holds or processes, its access to your systems, networks and premises, and where the data is stored
• Record the critical vendors' material subcontractors — the subcontractors that do a material part of a critical service, what they do and where they work, and any added since the last review
• Check the register holds what your regulator expects — regulated firms only: the information the outsourcing register must hold for your regulator, and which arrangements count as critical or important under its definition

For each critical vendor, compare what was delivered in the period with what the contract promised. Read the service and continuity reports, check that service credits were claimed, and meet the vendor to agree what needs to change.

• Collect each critical vendor's service reports for the period — the vendor's own service level reports, your incident and ticket data, and the business owner's view of the service
• Compare performance with the SLAs and KPIs in each contract — each service level and KPI against its target for the period, the misses, and whether the vendor's figures match your own records
• Check service credits and remedies were claimed — credits due under the contract for missed service levels, whether they were claimed and received, and any remedy or improvement plan the contract requires
• Review the vendors' continuity tests and incident reports — each critical vendor's latest business continuity and disaster recovery test results, its incident reports for the period and how it responded
• Hold a review meeting with each critical vendor — performance, open issues, changes planned at the vendor, and improvements agreed, with notes kept

Bring every problem with a vendor in the period into one log, then look for the signs that a vendor is weakening: its finances, its owners, its key people and the subcontractors it uses. A serious open issue with a critical vendor adds the escalation phase.

• Update the vendor issue and incident log — service failures, security incidents, data breaches, complaints and audit findings involving vendors in the period, with severity, owner and status, and whether a critical vendor has a serious open issue
• Check the critical vendors' financial health — filed accounts, credit reports and alerts, late filings, insolvency notices, and signs such as requests for early payment or changed bank details
• Check for changes at the critical vendors — a change of owner, a merger, new key people, a new strategy or locations, and new or changed subcontractors that could affect the service

Applies only when a critical vendor has a serious open issue. Tell the accountable executive now rather than in the report, work out who is affected, agree a fix and a date with the vendor, and decide whether to step up oversight, use the contract's remedies or start the exit plan.

• Escalate the issue to the accountable executive — a serious open issue only: what happened, which service and customers it affects, what the vendor has said and what has been done so far
• Assess the impact on customers, operations and obligations — customers and services affected, legal, contractual and regulatory obligations touched, and whether anyone outside must be told
• Agree a remediation plan and dates with the vendor — what the vendor will fix, by when, how you will check it, and the extra reporting you need until it is fixed
• Decide whether to step up oversight, use the contract's remedies or start the exit plan — the accountable executive's decision on the next step, with the reason, recorded before the report is written

Check that the evidence each vendor gave you is still current and that the contract terms are being kept: certificates, assurance reports and insurance due to expire, audit and access rights, subcontracting consent, data terms and the dates when contracts renew or end.

• Check certificates and attestations due to expire — each critical vendor's certificates and assurance reports, such as an ISO/IEC 27001 certificate, a SOC 2 report, Cyber Essentials or a PCI DSS attestation of compliance, the period they cover and when they expire
• Check vendors' insurance cover and expiry dates — the covers each contract requires (for example professional indemnity, public liability or cyber), the amounts, the expiry dates and any change or lapse in cover
• Check audit and access rights in the critical contracts — the right to audit, inspect and get information from each critical vendor, whether it was used in the period and whether it still works in practice
• Check subcontracting terms were followed — whether vendors asked before adding subcontractors or sub-processors where the contract requires it, and whether you were told of changes in time to object
• Check data protection and security terms are in place — a processing agreement for every vendor that processes personal data, breach notification terms, where the data is stored, and how it is returned or deleted at the end
• List contracts renewing or ending in the next 12 months — each contract's end or renewal date, the notice period and the date by which a decision to renew, renegotiate or leave must be made

Look at the portfolio as a whole: too much depending on one vendor, its group or one hidden provider behind several vendors. Then check that each critical vendor could be replaced and that its exit plan exists and has been tested. A missing or untested exit plan adds the task to fix it.

• Check concentration on single vendors and providers — several critical services with one vendor or its group, one cloud or data centre provider behind several vendors, and one vendor in several places in your supply chain
• Rate how easily each critical vendor could be replaced — easy, medium, hard or impossible to replace, how long a move would take, and whether the service could be brought back in-house
• Review the exit plan for each critical vendor — whether each critical vendor has a documented exit plan, when it was last reviewed or tested, and whether it still works with today's service, data and contract
• Write exit plans for critical vendors that have none — a missing exit plan only: the trigger for leaving, the alternative, the time and cost, the data and assets to get back, and who does what, with a date if it cannot be finished before the report
• Plan a test of each untested exit plan — an untested exit plan only: the kind of test (a desk walk-through, a data export or a trial move of part of the service), its date and owner, added to the action plan

Turn the findings into ratings and actions with owners, write the report and send it ahead of the meeting. The approver records the decision on the report and the action plan, and nothing after the approval can be completed until they do. Approved with changes and Not approved each add the task that follows from them.

• Rate each critical vendor's risk after the review — an overall rating for each critical vendor, the main reason, and whether it has risen or fallen since the last review
• Agree actions and owners for each finding — the action plan: each finding, the action, the owner, the due date, and the risks proposed for acceptance without an action
• Check whether the regulator must be told about anything found — regulated firms only: material changes or severe events affecting outsourcing arrangements, and any new reliance on a third party for critical or important functions, against your regulator's notification rules
• Write the oversight report — the portfolio and tier changes, critical vendor performance and ratings, issues and escalations, expiring evidence, contract gaps, concentration and exit plans, the action plan and the risks proposed for acceptance
• Check the report with the risk and information security leads — the ratings, findings and actions are fair and consistent, and nothing found in the review is left out
• Send the report and the action plan to the approver — with the meeting papers, in time for the approver and the committee or board to read them before the meeting
• Approve the oversight report and the action plan — the approver records Approved, Approved with changes or Not approved, the changes or reasons, and the risks accepted
• Make the changes and record them — Approved with changes only: each change made to the report or the action plan, with its owner and date
• Rework the report and ask for a new decision — Not approved only: make the changes the approver asked for, then ask them to change the decision on the approval task, or to un-complete it and record a new one

Oversight continues between reviews. Tell vendors and action owners what was agreed, update the records, set up the signs that should start an early review, and put the next review in the diary before closing the run.

• Tell vendors about the actions that need them — the improvements, evidence, contract changes and dates agreed with each vendor, confirmed in writing
• Brief the action owners — each owner knows their actions and dates, and how progress will be reported
• Update the vendor inventory, tiers and contract records — the tiers, owners, expiry dates, ratings and exit plan status agreed in this review, so the next review starts from them
• Set up monitoring between reviews — reminders for expiring certificates, insurance and notice dates, alerts on vendor finances and news, and the events that should start an early review of a vendor
• Set the next review date — when the portfolio will be reviewed again, and a schedule for it, with critical vendors reviewed more often if the approver asked
• Close the review and file the record — the final report, approval, action plan and evidence stored where the next review and any auditor will find them