What are vendor management best practices, and how do you apply them?

What are vendor management best practices?

Vendor management best practices are the habits that keep a vendor base under control after onboarding: one clean vendor list, effort set by each vendor’s risk and value, a named owner for key vendors, reviews that end in actions, constant watch on risk and changes, and a planned, documented exit. Each one prevents a known failure.

Vendor management, also called supplier management, is how an organisation manages the companies it buys from, from registration to exit. The definition and the six stages are on the supplier management pillar. How a new vendor is set up is covered in supplier onboarding best practices. This guide starts where onboarding ends: the vendor is approved, orders are flowing, and the work is to keep the relationship worth its cost and its risk.

The failures are familiar. A software vendor renews automatically for three more years because nobody owned the renewal date. A key component supplier is close to insolvency, and the buyer learns it from a late delivery. A contractor that left a year ago still has an active account in the building’s access system. Each practice below stops one of these.

Which vendor management practices matter most?

The table lists the practices that come back in most vendor management programmes, roughly in the order they are built. Each line names the problem it fixes and a simple figure that shows whether it works.

How do you decide how much effort each vendor gets?

You decide by putting each vendor in a segment, then giving each segment a fixed routine: who owns it, how often it is reviewed, how risk is watched and whether it needs an exit plan. The segment comes from three questions: how much you spend, how hard the vendor is to replace, and what stops if it fails.

The first two questions follow Peter Kraljic’s 1983 portfolio model, which sorts purchases by profit impact and supply risk; the supplier management pillar explains its four categories. The third question comes from regulated sectors. US banking regulators’ 2023 guidance on third-party relationships says that not all relationships present the same level of risk or criticality, and that monitoring should be more comprehensive or more frequent when a vendor supports higher-risk activities. ISO 9001 asks for the same proportion in quality terms: criteria to select, monitor and re-evaluate external providers.

Review the segment of each vendor when something changes: a new contract, a large rise in spend, access to new data, or an incident. A vendor that started as routine can become critical without anyone deciding it.

What does this look like for one company? A worked example

Take a fictional company with 2,400 vendor records in its ERP. Only 1,650 were paid in the last twelve months. Merging the duplicates among them under one parent company leaves 1,500 vendors. The 750 records with no payment in a year are blocked for new orders, which closes an easy route for fraud.

The same company then checks coverage rather than activity: what share of its spend sits with vendors that have an owner, a current scorecard and valid documents. That one figure tells management whether the programme covers the money and the risk, not just how many meetings took place.

How do you run vendor performance reviews that change something?

You run useful reviews by agreeing the measures in the contract, feeding the scorecard from data your systems already hold, and closing every meeting with actions, owners and dates. A review that only reads out scores changes nothing.

1. Before the meeting, the owner sends the scorecard: on-time delivery from goods receipts, quality from rejections or service tickets, price from invoices against the contract, and open actions from the last review.
2. The vendor comments in writing before the meeting, so the meeting is spent on causes and fixes, not on disputing the figures.
3. In the meeting, agree what will change, who does it and by when, on both sides.
4. After the meeting, record the actions in the vendor record and open the next review with them.
5. Once a year, step back: is the vendor still in the right segment, and is the contract still the right one?

Public buyers have formal versions of this routine. Under FAR 42.1502, US federal agencies evaluate contractor performance at least once a year, and when the work is completed, for contracts above the simplified acquisition threshold, and record it in CPARS for other agencies to read. In the UK, the Procurement Act 2023 requires contracting authorities to assess performance against published KPIs at least once every twelve months on contracts above £5 million. The measures, their formulas and the scorecard itself are explained in supplier performance management.

How do you keep vendor risk under control between reviews?

You keep vendor risk under control by watching for changes, not by waiting for the next review. The US interagency guidance lists what ongoing monitoring looks for, including changes in a vendor’s financial condition and changes to, or lapses in, its insurance cover, and says monitoring can be periodic or continuous.

• Dates that expire. Insurance, certificates, licences and the contract itself. Record each end date when the vendor is onboarded, and block new orders automatically when one passes.
• Lists that change. Sanctions lists are updated often. Screen active vendors again on each update, or at a fixed interval, not only once at onboarding.
• Events that trigger a check. A change of owner, a merger, a profit warning, a data breach, a sharp rise in spend, or a new type of access to your systems.
• Bank detail changes. Confirm every change through a phone number taken from your own records, never from the request, and keep the person who enters the change apart from the person who approves it.
• Information security. For IT and data vendors, ISO/IEC 27001:2022 includes a group of supplier controls in its Annex A (5.19 to 5.22), which cover information security in supplier relationships and in supplier agreements, and the monitoring of supplier services and their changes.

Bank changes deserve their own control because fraudsters target them. In the Association for Financial Professionals’ survey of 2024 payments fraud, 45% of respondents cited vendor impostor fraud, up 11 percentage points on the previous survey. Risk types, tiers and due diligence in depth are in vendor risk management.

How do you manage the relationship without managing every vendor closely?

You keep close relationship work for the few vendors in the top segment, and make the routine simple for everyone else. Close work means a joint plan, shared forecasts, one owner on each side and executive meetings. That is expensive in time, so it is worth it only where the vendor can change your costs, your quality or your ability to deliver.

Two habits help with every vendor. Keep one voice: when three departments negotiate separately with the same vendor, the vendor chooses which promise to keep. And pay on time: a vendor that is paid late every month will not put your orders first. How to choose the vendors that get a relationship plan, and how to run it, is explained in supplier relationship management.

How do you offboard a vendor safely?

You offboard a vendor safely by treating the exit as a short project with a checklist, started before the notice is sent. The US interagency guidance lists the points to plan for when a relationship ends: options to transition the service, risks around data retention and destruction, information system connections and access control, termination costs and fees, and the impact on customers.

1. Check the contract: notice period, termination fees, what the vendor must hand back and what happens to your data.
2. If the service continues, choose and prepare the replacement before notice is given, and plan the handover.
3. Send notice in the form and by the date the contract requires.
4. Get your data back in a usable format, then ask for written confirmation that copies are deleted or destroyed.
5. Remove access: system accounts, connections and keys, building badges and shared folders.
6. Close open purchase orders, settle the final invoices and credit notes, and recover any equipment or deposits.
7. Block the vendor record for new orders and payments, without deleting its history.
8. Record a final performance note, so the next buyer who considers this vendor can see why it left.

The record’s status changes during the exit, from active to blocked to archived, are covered in supplier lifecycle management.

How do you know your vendor management practices are still working?

You know by testing a sample, not by asking the team. Once a year, someone outside the vendor management team, such as internal audit or a colleague from another unit, picks a sample of vendors and checks that each has an owner, a current segment, valid documents, a recent review with closed actions and, for ended vendors, removed access. The US interagency guidance calls for periodic independent reviews of the third-party risk management process for the same reason.

Report a few figures to management each quarter: active vendors per vendor paid, share of spend with vendors that have an owner and a current scorecard, expired mandatory documents, review actions closed on time, and ended vendors with access removed. The steps, owners and records the programme runs are set out in the supplier management process.

What mistakes undo vendor management best practices?

• Reviewing everyone the same way. A yearly questionnaire sent to 1,500 vendors produces 1,500 unread answers and no time for the 15 that matter.
• Scores typed by hand. A scorecard that someone fills in from memory before each meeting stops being produced after a few quarters.
• Owners in name only. The owner listed in the record left the company a year ago. Check owners at every reorganisation.
• Exit terms added at the end. Once the relationship is ending, you have little leverage to agree how data comes back.
• Dormant records left active. Vendors not paid for over a year stay open, and become the easiest target for a fake bank change.
• Counting meetings instead of coverage. Many reviews held does not mean the critical vendors were reviewed.