DivisionCero

Vendor Management Procedure

How the vendor lifecycle is carried out: inventory, classification, risks, purchasing committee and external validation

Purpose

Define the operational how of the Vendor Management Policy: the steps, roles and records needed to inventory, classify, risk-assess, onboard and validate vendors before and during the business relationship.

Scope

Applies to every acquisition of goods or services involving a vendor, contractor or third party, managed by the Purchasing area with support from Information Security, Legal and the requesting areas.

Roles and Responsibilities

  • Purchasing: Maintains the inventory, performs the initial classification, and coordinates onboarding and external validation.
  • Information Security: Assesses security and continuity risks and defines the controls required according to criticality.
  • Purchasing Committee: Approves critical or high-risk vendors, reviews exceptions and decides on external validation findings.
  • Requesting Area: Justifies the need and takes part in the vendor's technical evaluation.
  • Legal: Reviews contractual clauses, T&Cs and specific conditions before signing.

1. Vendor Inventory

The Purchasing area maintains a centralized, up-to-date inventory of all active vendors, which includes at least:

  • Legal name, tax ID and contact details.
  • Goods or service provided and requesting area.
  • Onboarding date, contract term and next review date.
  • Current criticality classification (see section 2).
  • External validation status (see section 6).

The inventory is reviewed quarterly and cleaned up when contracts end or scope changes.

2. Vendor Classification Criteria

Each vendor is classified according to its level of exposure for the organization, considering:

  • Access to information: Whether it handles, processes or stores confidential information or personal data.
  • Access to infrastructure or systems: Whether it requires a connection to networks, applications or facilities.
  • Impact on business continuity: Whether its failure interrupts critical processes.
  • Exclusivity: Whether it's a sole vendor with no immediate alternative on the market.
  • Financial exposure: Purchase volume relative to the category budget.

Based on these criteria, the vendor is classified as Critical, High, Medium or Low, a level that determines the depth of due diligence, the review frequency and the applicable contractual clauses.

For each Critical or High vendor, Purchasing and Information Security assess the following risks:

  • Information security: Leakage, alteration or loss of information through access granted to the vendor.
  • Business continuity: Disruption of the vendor's service without its own contingency plan.
  • Legal and regulatory compliance: Non-compliance with applicable regulations (data protection, AML/CFT, labor).
  • Fourth party: Risk arising from the vendor's subcontractors without visibility or direct control.
  • Reputational: Association with improper practices or restrictive lists.
  • Financial: Economic instability of the vendor that compromises delivery.

Identified risks are treated in accordance with the Risk Management Policy and recorded in the vendor's file.

4. Purchasing Committee

A periodic internal session (monthly, or extraordinary when required) attended by Purchasing, Finance, Information Security, the requesting area and, for Critical vendors, Management. The committee:

  • Approves or rejects the onboarding of vendors classified as Critical or High.
  • Reviews the risks identified in section 3 and the proposed contractual conditions.
  • Evaluates the results of external validation (section 6) and decides on findings.
  • Periodically reviews the classification and performance of current vendors.
  • Keeps minutes of each session as a traceability record.

5. Vendor Onboarding

Every new vendor fills in the Vendor Onboarding Form, managed by Purchasing, which collects:

  • Legal and corporate data (tax registration, chamber of commerce certificate, relevant shareholding structure).
  • Commercial and financial references.
  • Bank details for payments.
  • Applicable certifications (quality, security, continuity) according to its classification.
  • Express acceptance of the Vendor Clauses and the Terms and Conditions for Vendors.

The completed form is a prerequisite for starting the contracting process and is filed in the vendor's file.

6. External Vendor Validation

Before onboarding, and periodically according to the classification (annually for Critical/High, every two years for Medium/Low), Purchasing checks the vendor against external sources:

  • Restrictive and control lists (OFAC, UN, Interpol, Clinton lists).
  • Criminal, disciplinary and tax records.
  • Financial situation and credit behavior.
  • Current legal existence before the Chamber of Commerce or equivalent.

Any adverse finding is escalated to the Purchasing Committee (section 4) before continuing or renewing the relationship.

Monitoring and Review

Purchasing reports quarterly to the Committee on the status of the inventory, expired classifications and pending validations. The procedure is reviewed annually or upon regulatory changes or relevant incidents with vendors.

Awareness Procedure

Communications plan, talks, phishing campaigns and validation checklists for the Awareness Program

Purchase Request

Format and workflow for requesting the acquisition of goods or services from vendors

On this page

PurposeScopeRoles and Responsibilities1. Vendor Inventory2. Vendor Classification Criteria3. Vendor-Related Risks4. Purchasing Committee5. Vendor Onboarding6. External Vendor ValidationRelated DocumentsMonitoring and Review