What is the supplier management process, step by step?
Short answer
The supplier management process is the routine an organisation runs to choose, contract, enable, monitor and renew or exit its suppliers, with an owner and a record at every step.
Key takeaways
- It has eight steps: set the rules, find suppliers, register and qualify, select, contract, enable for ordering, monitor performance and risk, then renew or exit.
- Each step needs one owner, one record that proves it happened, and one check before the next step starts. A step without an owner is a step nobody runs.
- The vendor management process is the same process under another name; IT teams add licence, security and renewal checks, and banks follow the regulators’ five-stage life cycle.
- Most failures happen between teams, not inside a step: a supplier used before it is registered, an award that never reaches the supplier record, a contract with no KPIs, a renewal nobody owns.
What is the supplier management process?
The supplier management process is the set of steps an organisation follows, for every supplier, from the first need to the end of the relationship: set the rules, find and check suppliers, select and contract them, enable them for ordering, monitor what they deliver, then renew or exit.
A common situation shows why it matters. A plant manager needs pallets quickly, calls a local firm and sends its invoice to accounts payable. Accounts payable cannot pay: the firm has no supplier record, no verified bank details and no purchase order. Nobody checked its insurance or compared its price with the existing contract. Each team did its own job; what was missing was an agreed order of steps, with a check before each one.
This page describes that routine across teams. The supplier management guide explains the discipline and its lifecycle stages; the supplier lifecycle management guide follows one supplier record through its statuses and requalification.
What are the steps of the supplier management process?
Most organisations run eight steps. Some merge two of them and the names vary, but the order holds. A supplier that skips a step usually causes a problem in a later one.
- Set the rules. Write down who may request a new supplier, which documents each type of supplier must provide, and how suppliers are grouped by spend and risk. A common grouping uses profit impact and supply risk (the Kraljic matrix). The result is a short procedure and a segmentation that decides how much effort each supplier gets.
- Identify the need and find suppliers. Check first whether an existing contract or framework already covers the need. If not, look at the market: trade directories, a request for information. The result is a short list of candidates.
- Register and qualify. Each candidate gives its legal and tax details and the documents its segment requires: insurance, certificates, financial statements, a security or sustainability questionnaire. Checks follow: legal entity, sanctions, bank details, documents in date (supplier onboarding lists them by country). The result is a supplier qualified for one or more categories.
- Select. Qualified suppliers compete through a request for quotation or a request for proposal, or a tender in the public sector. The buyer scores the answers against criteria set before the bids arrived. The result is an award decision with its reasons (strategic sourcing process explains how a sourcing project runs).
- Contract. The buyer and the supplier sign an agreement that fixes scope, prices, service levels, the measures used to judge performance, audit rights and the exit terms. For suppliers on a framework or panel, the framework agreement and its call-off terms play this role. The result is a signed contract, filed where the contract owner can find it.
- Enable for ordering. The supplier record is completed with the vendor account, payment terms, verified bank details and the ordering channel (catalogue, punchout or purchase order by email). Only now can the supplier receive a purchase order. The result is an enabled supplier in the ERP or procure-to-pay system.
- Monitor performance and risk. The contract owner tracks the agreed measures and holds reviews as often as the segment requires (supplier performance management). Risk alerts, such as an expired certificate, a sanctions match or a credit downgrade, trigger a fresh check (vendor risk management). For the few strategic suppliers, supplier relationship management adds joint plans and senior reviews.
- Renew or exit. Before the contract or framework ends, the category manager decides, on the performance and risk record, whether to renew, run a new competition or exit. An exiting supplier is blocked for new orders, paid for what it delivered, and then made inactive.
The steps form a loop. The renewal decision at step 8 feeds the next selection at step 4, and lessons from monitoring change the rules at step 1: for example, a new document required after a supplier failed a safety audit.
Who owns each step, and what record does it leave?
The process works when every step has one lead, a record that proves it happened, and a check that must pass before the next step starts. The table gives a common split; in a small organisation one person holds several roles, but the check still happens.
| Step | Lead | Also involved | Record it leaves | Check before the next step |
|---|---|---|---|---|
| 1. Set the rules | Head of procurement | Finance, legal, quality, information security | Supplier management procedure; segmentation criteria | Approved by management; reviewed at least once a year |
| 2. Find suppliers | Buyer or category manager | Requester | Need description; list of candidates | No existing contract already covers the need |
| 3. Register and qualify | Supplier data team | Quality, compliance, security | Supplier record; documents with expiry dates | Mandatory documents valid; sanctions and bank checks passed |
| 4. Select | Buyer or category manager | Requester, evaluators | Bids, scores, award decision | Criteria fixed before bids opened; conflicts of interest declared |
| 5. Contract | Buyer, legal | Contract owner | Signed contract or framework agreement | Signed within delegated authority; KPIs and exit terms included |
| 6. Enable for ordering | Supplier data team | Accounts payable | Vendor account, payment terms, ordering channel | Bank details verified by a call-back to a known contact; record approved by a second person |
| 7. Monitor | Contract owner | Requesters, risk owner | Scorecards, review minutes, risk alerts, improvement plans | Reviews held on schedule for the segment; open actions tracked |
| 8. Renew or exit | Category manager | Contract owner, legal | Renewal decision or exit plan | Decision taken before the end date, on the performance and risk record |
Ask one question per row: if this check fails, who stops the supplier from moving on? If nobody can, the check exists only on paper.
Standards and regulators ask for the same pattern. ISO 9001 requires criteria for evaluating, selecting, monitoring and re-evaluating external providers, and records of these activities. In US federal buying, a contracting officer must find a contractor responsible before award (financial resources, performance record, integrity, capacity), and the supplier must be registered in SAM when it makes an offer. Performance is then evaluated at least once a year in CPARS for contracts above the simplified acquisition threshold. In the UK, public contracts above £5 million need at least three published KPIs, assessed at least every twelve months.
Is the vendor management process different?
No. The vendor management process is the same process under another name: “vendor” is more common in finance, IT and US usage, “supplier” in procurement and manufacturing. The eight steps above apply as they are. Two settings add their own emphasis.
- IT vendor management
- The steps are the same, with extra checks at qualification (a security questionnaire, data protection terms, where the data is hosted), at contract (licence metrics, service levels, the right to get data back) and at renewal. Renewal matters more than elsewhere because software contracts often renew automatically unless notice is given before a set date. A renewal calendar with notice dates is part of step 8.
- Banks and regulated firms
- US banking regulators describe a third-party life cycle in five stages: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination. They map onto steps 1–2, 3–4, 5, 7 and 8 above. The regulators add that using a third party does not reduce the bank’s own responsibility, so the process must show who checked what.
Whatever the name, keep one process and one supplier record per legal entity. When IT runs a vendor process and procurement a supplier process for the same companies, there are two records and two answers to “are we allowed to use this firm?”.
What is the supplier agreement management process?
Supplier agreement management is the name of a process area in CMMI, a process improvement model used by software and engineering organisations. In CMMI for Development, version 1.3, its purpose “is to manage the acquisition of products and services from suppliers”. It has two goals: establish supplier agreements, and satisfy them, which the model describes as agreements “satisfied by both the project and the supplier”.
In practice it is the project-level part of the supplier management process. An engineering project that buys a component from a subcontractor chooses the supplier, writes the agreement, follows the supplier’s work and accepts what is delivered: steps 4, 5 and 7 above, for one project. The organisation-level steps (rules, registration, enablement, renewal) stay with procurement. A project team that skips the organisation’s supplier record creates suppliers that accounts payable has never heard of.
How does a supplier management system run the process?
A supplier management system runs the process as a workflow around one supplier record. It routes each step to its owner, stores the record each step leaves and blocks the next step until the check passes: no invitation to tender for an unqualified supplier, no bank change without a second approval, no new order after a certificate expires. People still decide; the system makes sure nobody skips a step. Configure it to follow a written process, or it will copy the current gaps into software. Types of tool and a method to choose one are in the supplier management software guide; the part suppliers see is in the supplier portal guide.
What does the process look like for one new supplier?
A fictional food manufacturer needs a second supplier of plastic packaging film, because its only supplier stopped for two weeks last year. The film touches the food, so it sits in a high-risk segment.
- Step 1 is already done: food-contact packaging suppliers need a food safety certificate, a declaration of compliance for food-contact materials and a site audit before the first delivery.
- Steps 2 and 3: no current contract covers a second source. Of five candidates, four register on the supplier portal; one has no valid food safety certificate and stops there.
- Steps 4 and 5: the three qualified suppliers answer a request for proposal scored on price, technical fit after line trials and lead time. The winner signs a two-year contract with delivery and quality targets, audit rights and a 90-day exit notice.
- Step 6: the supplier data team confirms the bank details by phone with a contact named in the contract, then enables the supplier for purchase orders.
- Step 7: deliveries are scored monthly and reviewed quarterly. In month eight the food safety certificate expires; the system blocks new orders until the renewed certificate arrives nine days later.
- Step 8: four months before the end date, the category manager reviews the scorecards and the market and renews for one year at a lower price against a higher volume.
Each step had a named owner and a check: the uncertified candidate never reached the request for proposal, the supplier received no order before its bank details were confirmed, and the expired certificate stopped orders instead of being found at the next audit.
Where does the supplier management process break between teams?
Most failures happen at a handoff, when one team finishes its step and assumes the next one knows. Five handoffs fail often.
- Requester to procurement
- A department uses a supplier before it is registered, and the invoice arrives first. Fix: no purchase order without an enabled supplier, and a short, fast route for urgent one-off purchases so that people do not go around the process.
- Sourcing to supplier data
- A tender is awarded but the supplier record still shows the old suppliers as preferred, so orders keep going to them. Fix: the award decision triggers the record update as part of step 5, not as a separate request.
- Contract to contract owner
- The contract is signed with KPIs, but nobody told the person who receives the service. Fix: name the contract owner in the contract file and hand over the KPIs and review dates at signature.
- Supplier to accounts payable
- An email asks to change the supplier’s bank account, and accounts payable updates it. Fix: bank changes go through the supplier data team, with a call-back to a known contact and a second approval.
- Monitoring to renewal
- The contract ends or renews automatically and nobody decided. Fix: a renewal date and a notice date in the system, with the category manager alerted early enough to run a new competition if needed.
A quick test: pick ten suppliers paid last month and trace each one back through the eight steps. Every missing record is a handoff to fix.
How do you write the supplier management process down?
Write one short procedure that every team can read, with checklists for the detail. It states the scope and its exceptions (for example, card purchases under a set value), the segments and the effort for each, the eight steps with their lead, record and check, the events that send a supplier back to an earlier step (change of owner, failed audit, expired document, sanctions match) and the system that holds the master supplier record. Review it once a year and after any serious supplier failure. When an auditor asks why a supplier was chosen, the answer should come from the records, not from someone’s memory.
Questions
How many steps does the supplier management process have?
There is no standard number; published versions range from four to ten. This guide uses eight: set the rules, find suppliers, register and qualify, select, contract, enable for ordering, monitor, and renew or exit. Shorter versions merge steps, for example registration with qualification, but they keep the same order.
Who owns the supplier management process?
Procurement usually owns the process as a whole: the procedure, the segmentation and the selection. Each step still needs its own lead. A supplier data team runs registration and enablement, quality and compliance approve documents, contract owners monitor delivery, and accounts payable controls payment. One owner for the whole process keeps the steps connected.
Does every supplier go through every step?
Every supplier that receives orders goes through registration, enablement and payment controls. The effort in the other steps depends on the segment. A one-off, low-value supplier can skip the formal selection and reviews; a critical supplier gets full qualification, a competition, regular reviews and an exit plan.
Is the supplier management process the same as the procurement process?
No. The procurement process runs for each purchase: need, sourcing, order, receipt, invoice and payment. The supplier management process runs for each supplier over time: rules, qualification, selection, enablement, monitoring and renewal. They meet at selection and at ordering, where only an enabled supplier can receive a purchase order.
New guides on the supplier management line
One short email when a guide on this line is added or revised. Nothing else.
Coming soon: sign-up opens with the first email.