<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

4 Features Every Vendor Management Solution Needs 

author Michael Berman
4 min read
Sep 16, 2019

A vendor management solution is more than a repository for contracts. It’s a system for reducing risk, ensuring compliance, and increasing efficiency across the enterprise by uncovering insights into third-party vendor relationships at every level of the vendor management lifecycle.  

When properly constructed, a vendor management software solution organizes existing processes and documentation while showing how vendor relationships and policies can be improved. 

How do you know a vendor management solution will accomplish these goals? 

Look for vendor management solutions that include these four vital features:

1. Vendor and risk management integration.

Vendor management doesn’t happen in a vacuum. The work conducted in vendor management touches many areas including IT, compliance, lending, marketing, business continuity planning, and others.

That means vendor management can’t be a standalone element. It needs to be integrated into other operational functions as a part of enterprise risk management (ERM).  

Consider contract provisions requiring prompt notification of a critical vendor security breach. The vendor management function might own contracts, but other areas have a vested interest in the subject. Compliance, IT, business continuity planning (BCP), and risk management all are subject to requirements that make it necessary for them to know whether third-party vendors are required to report security breaches, under what conditions, and how quickly the institution can expect notification. These are questions that must be answered in cybersecurity assessments, business continuity plans, and when measuring risk. 

When vendor management activity isn’t integrated into other key functions, it opens the door to a whole host of problems. Instead of leveraging each other’s work, different areas of the institution may end up duplicating efforts, introducing the potential for redundancies, inefficiencies, and discrepancies.  

A fully integrated vendor management solution helps a financial institution see the big picture and manage the process more efficiently by ensuring all areas of risk management are connected. 

2. Support from subject matter experts.

From vendors drafting convoluted contracts to regulatory guidance defining the elements of a compliant vendor management program, vendor management can be overwhelming and confusing without someone knowledgeable to show the way.  

A good vendor management solution needs more than just software. It needs support from subject matter experts — everyone from contracts lawyers and regulatory gurus with years of experience to IT professionals able to explain the ins and outs of the systems. 

Whether it’s understanding complex vendor documents or evaluating a unique vendor situation, the guidance you receive must be reliable and accurate.  

Just think of the last core contract you signed. That contract was long. Pricing figures were hidden throughout along with auto-renewals for a variety of products and services. Then there are other key provisions relating to BCP, audit rights, breach notification, termination clauses, and performance standards, among others.   

A good vendor management solution will have experts who know how to accurately map out complex vendor contracts, identifying the most important information to make it easy for you to find and act on. Knowing how to uncover these elements takes more than patience. It takes practice and a background in contract law. 

How do you know if a vendor management solution has insightful and experienced SMEs to support your institution? First, you can ask. Another option is to look at the company’s errors and omissions (E&O) policy. Is the provider willing to put its money where its mouth is in the event it makes an error, or is it only promising to re-do the work?

3. Proactive monitoring.

No matter how thorough your due diligence, things can go wrong with a third-party vendor. The key is having systems in place to identify problems when they occur and then having a plan to address the problem. 

This requires ongoing monitoring. It’s particularly helpful to have two different types of monitoring: ongoing due diligence and real-time vendor cyber monitoring.  

Ongoing due diligence involves collecting and analyzing third-party reports like SSAE 18s as well as actively monitoring regulatory, legal, and financial news to uncover existing problems. A vendor management solution should conduct ongoing due diligence on your behalf, removing the burden of hunting down and reading reams of documents, and provide actionable alerts when an issue is uncovered.  

Vendor cyber monitoring also plays an important role. Reports and news alerts tell us what happened in the past, but 24/7 cyber monitoring can alert an institution of a problem as soon as it's detected, long before the vendor gets around to informing you. By promptly uncovering current threats before they are publicly reported, real-time cyber monitoring lets a financial institution take immediate action. 

A vendor management solution should also provide a response plan with concrete steps for addressing vendor issues. For example, it might provide a form letter requesting a root cause analysis of a data breach. 

Not only does this help an institution quickly respond to a risk, it also shows examiners that the institution is well-equipped to respond to problems.  

Read also: Your Vendor Shortlist is Not a State Secret

4. Fixed, forecastable pricing.

Budgeting is complicated enough without being surprised by add-on fees. From gathering due diligence documents and running reports to seeking guidance if a critical vendor experiences a breach, thorough vendor management involves regularly seeking out and reviewing new information.   

These charges can quickly add up. It’s kind of like an airline ticket. You think you’re getting a great buy for a flight from Nashville to Orlando, but once you add a carry-on bag and decide you’d like to select your seat and spring for Wi-Fi, the price gets a lot higher. Heaven forbid you decide you need to buy a drink or snack.  

It’s far more efficient to seek out a solution where the amenities you know you are going to need are already included. Instead of agonizing over which items you absolutely need for each vendor and which you can do without because the budget is already maxed out, fixed pricing makes sure you can always get the resources you need, when you need them.  

 

Related: Vendor Risk Countdown: Top 10 Risks Third-Party Vendors Pose to Your Financial Institution

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Regulatory Compliance Management Nrisk News & Updates HMDA Risk Mortgage Lenders Vendor Management Ncomply Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Business Continuity Third-Party Vendor Management Cybersecurity Fintech NVendor Strategic Planning Ncyber Regulatory Updates Ntransmittal Audits & Findings OCC Regulatory Compliance Company Culture Audit Nverify Compliance Management Exams FDIC Nfindings Findings NCUA Contract Management Employee Intranet Business Continuity Management Contract FRB Findings Management Enterprise Risk Management FFIEC Ncontracts manager Third-Party Vendors Vendor Risk Vendor Risk Management Wealth Management 1071 ABA Bank Access Control Artificial Intelligence Audit Findings Board Portal Call Report Compliance Risk Cybersecurity Assessment Digital Tansformation Due Diligence Efficiency Employee Engagement Exam findings FIEC Governance and Risk Management Inc. 5000 Internal Audit Management Mortgage Lending Nboardportal Verify integrated risk management
Does Vendor Size Matter?
Banks

Does Vendor Size Matter?

Feb 27, 2017 1 min read
Sharing BSA Resources with Another Institution? Third-Party Vendor Management Rules Apply
Banks

Sharing BSA Resources with Another Institution? Third-Party Vendor Management Rules Apply

Oct 9, 2018 1 min read
Due Diligence Documentation: 9 Common Mistakes
Banks

Due Diligence Documentation: 9 Common Mistakes

Jun 9, 2020 3 min read