What Is Vendor Management? [Complete Guide]

Table of Contents

Bonus Material: Implementing Risk-Based Third Party Management Guide

What Is Vendor Management: Introduction

While watching a large symphony orchestra, you witness a smooth and beautiful performance. This performance is the result of numerous instrumental sections working together in perfect harmony. The director of the orchestra knows that without harmonizing a group of individual musicians, the collective orchestra can never achieve the envisioned sound.

This analogy demonstrates how an organization’s success is determined by how well its pieces perform together. In today’s interconnected business world, you can think of organizations as conductors of an orchestra. Virtually every company relies on third party vendors to provide them with critical services to help their business thrive.

However, it’s important to take responsibility for the actions of those vendors that you rely so heavily on; you may outsource processes, but you cannot outsource the risk associated with such processes. It’s impossible to have a direct line of sight on your third party operations, so how can you effectively manage any risks they pose to your organization?

An effective vendor risk management program can protect your company from unacceptable negative impacts caused by third parties. In this guide, we’ll discuss what a vendor management process looks like, explain what should be built into your vendor management policy, dive into some vendor management best practices, and finally present a solution for ensuring the success of your vendor management program: Enterprise Risk Management (ERM) software.

Vendor Management Process

A vendor management process describes the manner in which you keep track of the following types of questions related to the third parties at your organization:

Who are they?
What services do they provide?
What sensitive information do they have access to?
Which internal policies apply to them?

Making sure that a vendor due diligence checklist is carried out is an essential part of your vendor management process. Along with staying informed about your third party vendors, your process should also analyze and manage suppliers so that it optimizes the way your organization interacts and leverages its suppliers.

Vendor Management Policy

Your vendor management policy ties your organization’s unique set of risks to the way in which you manage your vendors. It is a best practice framework that identifies which vendors pose risk to your organization, and subsequently outlines the controls your company needs to put in place in order to mitigate those risks.

So what type of information should your vendor management policy contain? Start by defining requirements of each of your vendors as it pertains to the following areas:

Human resources
Physical security
Data security
IT maintenance
Vendor management (how this vendor manages their vendors)
Business continuity & disaster recovery
Incident management
Compliance

Establishing guidelines and requirements surrounding the areas listed above is a good starting off point. However, the way in which you govern the implementation of those guidelines is most important.

Vendor Management Best Practices

One of the easiest ways to understand best practices for vendor risk management is by looking at examples of vendor risk management failure. Take for instance the recent J.M. Smucker Company scandal: in February 2018, the FDA announced that low levels of an animal euthanasia drug were detected in canned dog food produced by Smucker’s. Their stock subsequently dropped by 3% resulting in a loss of more than $400 million in market value.

After the fact, the company stated that they’d identified the root cause of the poisoning to be one single supplier and a single ingredient used at one manufacturing facility.

Had Smucker’s taken a root cause approach to their vendor risk management process, they would have started by administering risk assessments to key vendors, and risks at those facilities would have been uncovered, prioritized, and mitigated.

Performing a risk assessment helps to identify the true root cause. Your risk assessment can then serve as a roadmap as you design an efficient workflow to make sure that ultimately, you’re protecting your business’ best interests.

Aside from starting off by performing a risk assessment, here are some best practices for taking a risk-based approach to pre-existing and new vendor relations:

Don’t allow negligence within your vendor’s operations to impact your business functions. Make sure your critical vendors are managing the safety of their own employees as you’re managing the safety of yours.
Know where your vendors and your vendors’ vendors are located. This will keep you tuned into external factors that may be affecting their geographic area at any given time.
Assess your vendors’ financial implications. Are your vendors contributing to a positive ROI? Taking note of this will help you keep track of which relationships are most valuable to renew.
Before agreeing to a new vendor relationship, make sure that their value add is unique. Setting this standard helps you keep unnecessary business expenses to a minimum.
Automate your onboarding process. Create a reusable but customizable vendor request profile for external contacts to submit. Use this form as a means to add any complex questions that may impact your vendor decision making.

Enter all new partnerships with comprehensive risk data. Ask the hard hitting questions early on; the wellness of your business depends on it.

Experience a Customized Vendor Management Solution

LogicManager offers customizable ERM software that includes a robust vendor management solution. Our vendor management software was built with you in mind, because it’s designed to help you align strategic goals with operational objectives. By giving you an enterprise-wide view of your risk at all times, LogicManager drastically reduces the time and money you spend on vendor management, and helps you grow your expertise to make sure those important third party vendors are managed correctly.

Explore some of the pre-built, industry-specific content that comes with LogicManager. We’ve created these custom plugins to make your risk management process a painless one:

The LogicManager plugin marketplace can be browsed by industry and function. Contact your advisory analyst to request access to templates directly in the LogicManager product. We also encourage you to download our vendor management datasheet to learn how our software creates a comprehensive repository of your organization’s vendor relationships.

You May Also Like: What Should Be Included In A Vendor Contract

Conclusion

Vendor risk management has a lot of moving parts and is an important part of a wider GRC program. Without keeping track of your critical third party relationships, your organization is hindered from successful performance.

When you sign on with LogicManager, you not only gain access to our comprehensive Vendor Management software, but we’ll also pair you with a team of advisory analysts who are as invested in your success as you are.

Free Download:
How to Implement Risk-Based Third-Party Management

Learn what vendor management risk failures look like and 7 steps to manage this process.