top of page

Vendor Management Process/ Third Party Risk Management

This paper does not attempt to define or discuss Vendor Management or Third-Party Risk Management.

The objective of writing this paper is to bring out the fact that Vendor/ Third Party Risk Management is not only an important task in a Resilient Organisation but also mammoth too!

Our supply chains have grown long, deep, and complex. Our dependency on third parties has increased due to multiple reasons e.g. cost effectiveness, technological advancements and dependencies, automation in product and services development and delivery, specialization in process, product, technology, etc.

Some organisations have hundreds and thousands of suppliers.

The following section describes the type and amount of data that needs to be collected from and about vendors.

S. No.

Vendor Data

1. Basic Vendor Information:

  • Vendor name

  • Vendor type

  • Legal business name

Contact information (primary) –

  • Address

  • Phone

  • email

Contact information (primary) –

  • Address

  • Phone

  • email

2. Financial Data:

  • Payment terms and conditions

  • Billing and payment history

  • Pricing details and rate cards

  • Creditworthiness and financial stability

  • Tax identification numbers

3. Contractual and Legal Data:

  • Contracts and agreements

  • Terms and conditions

  • Legal documentation (licenses, permits, certifications)

  • Non-disclosure agreements

4. Performance Metrics:

  • Delivery times and reliability

  • Quality of goods or services

  • Defect rates and returns

  • Repeat offenders

  • Compliance with specifications

5. Inventory and Stock Data:

  • Inventory levels and stock availability

  • Lead times for restocking

  • Forecasted demand and supply

6. Risk Management:

  • Risk assessment and mitigation plans

  • Business continuity plans

  • Supplier sustainability and ethical practices

  • Other plans like Incident Management, Crisis Management, IT Disaster Recovery, Information/ Cybersecurity, etc.

7. Compliance and Regulatory Data:

  • Regulatory compliance (industry standards, government regulations)

  • Environmental and safety certifications

  • Product labeling and documentation requirements

  • Other management systems Operational Resilience

8. Communication and Interaction Data:

  • Communication history (emails, calls, meetings)

  • Issue resolution and escalations

  • Feedback and complaints

  • Improvements based on feedback and complaints

9. Vendor Relationships:

  • Relationship history and engagement

  • Account management and points of contact

10. Market Intelligence:

  • Market trends and competition analysis

  • New product or service offerings

11. Geographic and Demographic Data:

  • Vendor location(s)

  • Geographic reach and distribution capabilities

12. Intellectual Property and Proprietary Information:

  • Protection of sensitive data and intellectual property

  • IP ownership and licensing agreements

  • Papers/ articles/ copyrights/ patents developed/ achieved

13. Performance Benchmarks:

  • Vendor performance against industry benchmarks

  • Key performance indicators (KPIs) comparison

14. Sustainability and Corporate Social Responsibility:

  • Environmental impact and sustainability initiatives

  • CSR practices and compliance

  • Money spent v/s achievements

15. Innovation and R&D Collaboration:

  • Collaborative innovation projects

  • Joint research and development initiatives

  • CoEs (centers of excellence) established

16. Analytics and Reporting:

  • Data analysis on vendor performance

  • ustom reports and dashboards for decision-making

17. Emerging Technologies and Trends:

  • Adoption of emerging technologies (e.g., blockchain, AI) by vendors

18. Contractual Compliance:

  • Monitoring adherence to contractual terms and SLAs

19. Employee and Resource Allocation:

  • Key personnel and resources dedicated to vendor management

20. Change Management:

  • Vendor-related organizational changes (mergers, acquisitions)

  • Total number v/s successfully implemented changes

  • Improvements based on changes (effectiveness check)

21. Data Security and Privacy:

  • Data protection measures for sensitive vendor data

  • Information security assessments and certifications

  • Training and awareness interventions, budgets, etc.

22. Regulatory Compliance:

  • Adherence to industry-specific regulations and standards

  • Compliance with data protection and privacy laws

23. Health and Safety:

  • Compliance with health and safety regulations

  • Occupational safety practices for vendor employees

24. Environmental Impact and Sustainability:

  • Carbon footprint and emissions data

  • Sustainable sourcing and production practices

  • Commitment to UN SDGs

25. Customer Delight:

  • Customer satisfaction surveys related to vendor performance

  • Alignment of vendor services/products with customer needs

  • NPS

26. Employee Satisfaction:

  • Treatment of vendor employees

  • Work conditions and fair labor practices

  • NPS

27. Ethical Business Practices:

  • Business ethics and transparency

  • Anti-corruption measures and policies

28. Innovation and Continuous Improvement:

  • Vendor contributions to innovation and product/service enhancement

  • Continuous improvement initiatives

29. Crisis Management and Business Continuity:

  • Vendor's crisis response and business continuity plans

  • Redundancy and backup strategies for critical supplies/services

  • Link with Risk Management (6) above

30. Other Management Systems

  • Preparedness/ plans for Quality, Information, Cybersecurity, Environment, Energy, etc.

  • Link with Risk Management (6) above

31. Digital Transformation:

  • Vendor's digital capabilities and technological integration

32. Social Responsibility:

  • Community Involvement and Social Impact Initiatives

33. Accessibility and Inclusion:

  • Accessibility considerations for products/services

  • Inclusive practices for diverse customer bases

34. Product Quality and Safety:

  • Quality control measures and product safety certifications

35. Training and Development:

  • Training programs for vendor employees

  • Professional development opportunities

  • Competency needle movement

36. Intellectual Property Protection:

  • Protection of proprietary information and IP rights

37. Corporate Governance:

  • Vendor's governance structure and practices

38. Dispute Resolution:

  • Mechanisms for resolving conflicts and disputes

39. Political and Social Stability:

  • Assessment of potential political and social risks in vendor's operating regions

40. Energy Efficiency:

  • Energy consumption and efficiency initiatives

41. Waste Management:

  • Waste reduction and recycling practices

42. Lawsuits and Legal Issues:

  • Past or ongoing legal disputes involving the vendor

  • Penalties – number and amounts

43. Insurance Coverage:

  • Vendor's insurance coverage and liability – types (including business interruption, cybersecurity, ransomware) and amounts

44. Economic Viability:

  • Vendor's financial stability and solvency

45. In-country or Local Regulations:

  • Compliance with regulations specific to the vendor's operating country/region

46. Supply Chain Visibility:

  • Transparency into upstream and downstream supply chain partners

  • Existence of up-to-date supply chain maps

47. Vendor Reputation and Brand Image:

  • Public perception and reputation of the vendor

48. Materiality Assessment:

  • Identification of material aspects

  • Quantitative and qualitative evaluation

  • Risk and opportunity analysis

  • Stakeholder perspective

  • Scalability and feasibility

  • Ranking and prioritization

  • Continuous review and adjustment

49. Supply Chain Data (vendor’s vendors):

  • Tiered supplier relationships

  • Supply chain disruptions and risk assessment

  • Almost all of the above (1-48) will be applicable/ repeatable

I propose a new post of the Chief Vendor Data Manager to collect, manage, analyse, and use such a huge amount of data. He/ she will have close association with the Third Party Risk Management (TPRM), Vendor Onboarding, and Vendor Management processes. Managing the comprehensive Vendor Data would require a skilled and knowledgeable professional who possesses a combination of strategic, analytical, and organizational skills.

Here is a possible and detailed JD (job description for this person):

Title: Chief Vendor Data Manager

Role Overview: The Chief Vendor Data Manager is responsible for overseeing and optimizing the entire Vendor Data Management process for the organization's key vendors. This role involves collecting, analyzing, and managing data across various aspects of vendor relationships to ensure compliance, quality, efficiency, and sustainability. The Chief Vendor Data Manager collaborates with cross-functional teams, vendors, and stakeholders to drive strategic vendor management initiatives.

Qualifications and Skills:

  • Educational Background: A bachelor's or master's degree in business administration, supply chain management, procurement, or a related field. Advanced degrees or certifications in vendor management or data analytics could be beneficial.

  • Experience: Minimum 10 years of experience in vendor management, supply chain management, procurement, or a related field, with a track record of successfully managing complex vendor relationships and data-driven initiatives.

  • Analytical Skills: Strong analytical abilities to interpret data, identify trends, and extract meaningful insights to drive decision-making and strategic initiatives.

  • Communication and Collaboration: Excellent communication and interpersonal skills to effectively interact with internal teams, vendors, and stakeholders. Collaboration is essential to align vendor data management with organizational goals.

  • Project Management: Proficiency in project management methodologies to oversee the entire data management process, from data collection to analysis and reporting. A relevant certification will be advantageous.

  • Regulatory and Compliance Knowledge: Understanding of industry-specific regulations, compliance standards, and best practices related to vendor management and data privacy.

  • Technical Proficiency: Familiarity with data management tools, analytics software, and technology solutions used for data collection, analysis, and reporting.

  • Negotiation Skills: Ability to negotiate contracts, terms, and conditions with vendors to ensure mutual benefit and compliance.

  • Strategic Thinking: A strategic mindset to align vendor data management with the organization's objectives and long-term goals.

  • Attention to Detail: Meticulous attention to detail to ensure accurate data collection, analysis, and reporting.

  • Ethical and Transparent: Commitment to ethical business practices and transparency in vendor interactions.

  • Leadership and Influencing: Leadership skills to guide cross-functional teams and influence stakeholders in adopting data-driven vendor management strategies.


  • Develop and implement a comprehensive Vendor Data Management strategy aligned with the organization's goals and values.

  • Collect, monitor, and analyze data across the 49 data points outlined in the case study.

  • Conduct materiality assessments to prioritize data collection and analysis efforts.

  • Collaborate with vendors to ensure compliance, quality, and sustainability in vendor relationships.

  • Regularly review and update vendor contracts, terms, and conditions based on data insights.

  • Provide data-driven insights and recommendations to senior management for informed decision-making.

  • Drive continual improvement initiatives to enhance vendor relationships and operational efficiency.

  • Oversee crisis management and business continuity plans in collaboration with vendors.

  • Monitor market trends, emerging technologies, and regulatory changes that impact vendor management.

  • Build and maintain strong relationships with key vendors and stakeholders.

  • Ensure data security and privacy compliance throughout the vendor data management process.

Application process: Please submit an updated CV with a case written of your own depicting as many as possible skills out of those mentioned above – what and how did you do in Vendor Data Management. The case will be given weightage over the CV and will also form the main part of pre-employment discussions.

The rest of the paper focuses on one of the most important tasks in Vendor Management i.e. NDAs – non-disclosure agreements (and you may like to include this skill in the JD above).

One of the first tests to enhance the Resiliency of your vendor Program is to ensure that the NDAs with all (or at least the key vendors) are up-to-date.

The big question is how this Chief Vendor Data Manager can be sure that the vendor is in compliance with NDA. This can be a big challenge as there is no Thermometer to gauge this and the assessment is based on trust and monitoring.

I add another challenge to this non-disclosure – the most (and easily) we think is about data (leakage or theft), but there is a lot of non-data information that the vendors have access to while they are providing services to you. The bigger or more critical a vendor is the more they have access to your information (data and non-data) and the bigger is the risk! While NDAs are common and standard for all vendors! NDAs do mention the non-data information e.g. proprietary processes, intellectual property, trade secrets, and other forms of confidential information beyond just data, but these mostly get transferred to systems (data). The portion that remains in the human brain is a big risk.

There are multiple defense mechanisms with respect to NDAs with vendors:

1. Initial (signing the NDA itself) - this is the first wall and is non-negotiable.

2. Preventive - training & awareness (at both sides), audits, reviews etc will fall in this.

3. Detective – the most difficult one where the intention is to catch a possible breach or a breach that has taken place. I will write a little more about this.

4. Corrective - legal course, penalties, etc. will fall in this category.

NDA compliance can be ensured through the following:

Physical Audits: All securities start with Physical Security. Conduct physical audits or inspections of the vendor's facilities or operations to detect any unauthorized access or handling of confidential information. Look for any signs of tampering or misuse.

Access Controls: Check that the vendors have implemented access controls and security measures for all assets. This can include surveillance cameras, secure storage, restricted access areas, role based access to information/ data, least privilege access, maker-checker, and other information/ cybersecurity related good practices.

Visitor Logs: Check that the vendors maintain visitor logs for vendor sites. Analyze these logs to identify any unapproved access to confidential information by external parties.

Document Tracking: Check that the vendors use tracking mechanisms like barcodes or RFID tags on physical documents and assets covered by the NDA. Regularly audit the location and use of these assets.

Recruitment, onboarding of employees: Check that the vendors have good recruitment (including BGC – background check) and onboarding processes for their employees.

Intellectual Property Audits: Check that the vendors have intellectual property management processes. Periodically assess these processes and inventory to verify that your confidential information is appropriately safeguarded.

Interviews and Questioning: Check that the vendors have an efficient exit process. As part of exit interviews or vendor assessments, ask specific questions related to confidential information covered by the NDA. Employees leaving the vendor may provide insights into potential breaches.

Whistle Blowing: Check that the vendors’ employees can use your while blower arrangements to provide certain intelligence.

Behavioral Indicators: Monitor vendor employees' behavior and any changes that might suggest potential breaches of confidential information, such as unusual interest or attempts to access proprietary processes.

Supplier Audits: All the above could be covered through or under these audits.

Most of the above measures are Detective in nature. Adapt these measures to the specific type of confidential information covered by your NDA agreements and work closely with legal counsel to ensure compliance with the terms of your NDAs and applicable laws (as these are detective in nature).

The vendor may have to tweak its exit process to let the clients be in the interview or have access to that information. Also, to remind leaving employees of the continued applicability of the NDA (this is rarely done in any organization currently).

You may have to tweak your whistle blower process to allow vendors’ employees to use it.


In conclusion, effective Vendor and Third-Party Risk Management is an indispensable component of a Resilient Organization. The paper underscores the vast and intricate landscape of vendor relationships, emphasizing that managing vendor data is an increasingly complex task, encompassing both data and non-data confidential information. It introduces the pivotal role of a Chief Vendor Data Manager and outlines a comprehensive job description to address this mammoth responsibility.

NDAs, which play a critical role in safeguarding confidential information, are a cornerstone of vendor management. However, ensuring NDA compliance goes beyond mere paperwork; it necessitates a multifaceted approach that encompasses preventive, detective, and corrective measures. The detective category, as discussed, presents an array of strategies to identify potential breaches or risks, not only pertaining to data but also to the non-data elements that often reside in the minds of vendor employees.

By combining these measures, organizations can enhance their resilience and foster robust partnerships with vendors. The synergy of trust, monitoring, and the strategic insights provided by a dedicated Chief Vendor Data Manager forms a powerful defense against the ever-evolving challenges of third-party risk. In an era where vendor relationships are pivotal to business success, these efforts are paramount to secure, protect, and thrive in an environment of growing complexities and dependencies.

65 views0 comments
bottom of page