01
Why the spreadsheet era ends
A spreadsheet works while one person can hold the whole picture. It breaks when procurement, technology, privacy, business continuity and compliance each maintain a partial view, none of which reconciles. The symptom is familiar: an urgent request for the list of critical vendors produces three different answers and a week of manual reconstruction.
The deeper problem is that a static list records what was agreed, not what is currently true. Services change, subcontractors change, data moves, contacts leave. Oversight that only refreshes annually is blind for eleven months at a time.
02
Build the inventory around services, not contracts
Contracts are a legal construct; risk attaches to services. A single master agreement may cover twelve services with very different criticality, data exposure and recoverability profiles. Mapping each service to the internal business process and the critical operation it supports is what makes concentration and impact analysis possible.
- One record per service, linked to its contract and accountable executive
- Mapped dependencies: business process, application, data classification, jurisdiction
- Criticality tier derived from impact of failure and substitutability
- Material subcontractors and processing locations recorded and refreshed
03
Tier the effort so the program stays sustainable
Applying the same due-diligence pack to a critical core-banking provider and a stationery supplier guarantees the program collapses under its own weight. Tiering should determine evidence depth, assessment frequency, contract requirements, monitoring intensity and reporting visibility — and the tiering logic itself should be documented and independently reviewable.
04
Replace point-in-time review with continuous signals
- Service-level and availability reporting reviewed against contractual thresholds
- Independent assurance reports (SOC 2, ISO 27001, penetration test summaries) tracked to expiry
- Financial-health and adverse-media monitoring for critical providers
- Incident and complaint feeds routed back into the vendor record
- Change triggers: ownership, subcontracting, data location, material service change
05
Make remediation the visible part of the program
Assessments create findings; programs are judged on how findings close. Every gap should carry an owner, an agreed action, a due date, a risk acceptance path with defined approval authority, and evidence at closure. Ageing remediation is the clearest early indicator that a program is administrative rather than operational.
06
Reporting that supports challenge
Executive and board reporting should answer four questions plainly: which arrangements could stop a critical operation, where is the institution concentrated, what has gone wrong recently and what was learned, and what remains unresolved. Vendor counts and completion percentages alone do not support informed challenge.
What good looks like
- A single authoritative service-level inventory owned by a named executive
- Documented tiering logic that drives diligence depth and monitoring frequency
- Contract terms standardized by tier, with tracked exceptions
- Continuous monitoring signals feeding the same record as the assessments
- Remediation tracked to closure with evidence, and ageing reported upward
- Tested exit plans and a current concentration view for every critical arrangement
This article describes common practice and publicly available Canadian regulatory expectations. Requirements vary by regulator, charter and risk profile — confirm your obligations with counsel and your principal regulator.
Frequently asked questions
When does a spreadsheet stop being adequate for vendor management?
+
Usually at the point where more than one team maintains its own list, where evidence must be produced on demand for a regulator or auditor, or where the number of tiered arrangements exceeds what one owner can refresh reliably each cycle. The failure mode is not the tool — it is the absence of a single authoritative record with owners, dates and evidence.
What belongs in a critical vendor inventory?
+
Legal entity and parent, service description, the internal business services and critical operations supported, criticality tier, data classification and locations, material subcontractors, contract dates and renewal notice, service levels, assessment status, incident history, exit plan status and the accountable executive.
How often should vendors be reassessed?
+
Most institutions reassess critical vendors annually and lower tiers on a two- to three-year cycle, with event-driven reassessment triggered by incidents, adverse findings, ownership change, material service change or a shift in data location or subcontracting.
Who should own vendor risk — procurement, risk or the business?
+
The business owner accountable for the service should own the risk, supported by procurement for commercial and contract execution and challenged by a second-line risk or compliance function. Splitting ownership across functions without a named accountable executive is the most common cause of stalled remediation.
What metrics indicate a healthy vendor program?
+
Coverage (share of spend and services in the inventory), currency (assessments completed within cycle), concentration by provider and technology, incident and service-level breach trends, remediation ageing, and the share of critical arrangements with tested exit plans.