Running a supplier review that still makes sense in two years

A supplier review usually makes sense to the person doing it, on the day. The trouble comes later: a customer’s security questionnaire, an audit, an incident, or simply a new colleague asking why a supplier was approved. If the reasoning only exists in someone’s memory, it has gone.

These six habits keep a review explainable long after it was done.

1. Start with what the service touches

Before asking the supplier anything, write down what the service does for you: the data it handles, any access it has to your systems, how much you rely on it, how easily you could replace it and where it operates. This is the inherent exposure, and it decides how deep the review should go.

A courier delivering stationery and a bureau running your payroll should not get the same questions. Matching the depth of review to the exposure keeps the process proportionate, and it is easy to explain later.

2. Review a service, not a company

Many suppliers provide more than one service. Record the decision against the specific service and use, not the supplier as a whole. “Approved for payroll processing” is a decision you can defend. “Approved” is not.

3. Keep the exact documents you relied on

Suppliers update their policies and renew their certificates. If you only keep the latest copy, you lose the document your decision was based on. Keep each version, note which one you reviewed, and check whether its scope covers your service.

4. Write the gap down, even when you accept it

Most reviews find something. Record each gap as a finding with an owner and a severity, and record the risk it creates. If you decide to go ahead anyway, the record should say so, and why.

Keep risks individual. An overall rating that averages a critical gap with a dozen good answers hides exactly the thing someone will ask about.

5. Record the decision as a decision

A decision record that holds up has, at minimum:

• the outcome: approve, approve with conditions, reject or defer
• who decided, and their authority to do so
• the reasons, in a sentence or two
• the documents and versions relied on
• the rules in force at the time, such as your risk thresholds
• any conditions, with dates
• when it should be looked at again

Once recorded, do not edit it. If something changes, record a new decision that refers back to the old one.

6. Decide in advance what makes you look again

Set a review interval that matches the risk, and treat certain events as reasons to look again: evidence expiring, a condition falling due, or the supplier telling you something material has changed, such as where they host your data.

When that happens, a person should decide whether it matters. Quietly downgrading or upgrading a supplier without anyone deciding is how records stop meaning anything.

How Vendwise helps

Vendwise is built around these habits: exposure per service, evidence kept by version, findings and risks kept individual, decisions that cannot be edited and that record exactly what they relied on, and changes that arrive as proposed reviews for a person to weigh up.