Model policy · version 1
Vendor Management
Know every vendor you depend on, how much risk each one carries, and prove you looked before you signed and keep looking after. Your sponsor bank inherits the risk of your critical vendors, so it approves them, examines them, and expects notice when they change.
What’s in this policy15 sections · Vendor Management · Read the full policy
9Obligations · things you must do
15Evidence · records that prove it
1Monitoring · checks and deadlines
1Reporting · reports you must send
Does this apply to you?
Answer a few questions and each obligation is marked applies, likely, or needs more information.
Tell Leela about your companyHand over the whole policy
Every obligation in this policy, in one request.
What the policy requires
Automate
Leela can perform the work through your connected systems.
Monitor
Leela can watch for the trigger, keep the clock, and flag what is late.
Prepare for review
Leela can prepare the artifact and hand it to a person for review.
Human required
A person must do the work; Leela can track it and file the evidence.
TriggerContinuous · Updated at every lifecycle step; checked at the annual review
EvidenceVendor inventory
TriggerEvent-driven · At engagement, at each annual review, and on material change
EvidenceTier assignment
TriggerEvent-driven · Each new vendor, before contract execution
EvidenceDiligence memo or summary, Supporting materials
TriggerEvent-driven · Each new contract and each renewal or amendment
EvidenceExecuted contract with provision checklist
TriggerEvent-driven · 30 days before a new critical contract; 60 days before ending one; promptly on adverse change
EvidenceSponsor bank approval, Notice log
TriggerAnnual · Annual for Tier 1 and 2; at renewal for Tier 3
EvidenceAnnual review record, Current SOC 2 or comparable attestation
TriggerEvent-driven · On each vendor issue; promptly to the bank for critical providers
EvidenceVendor issue record, Bank notice
TriggerQuarterly · Quarterly to the CEO; annual review summary to the sponsor bank
EvidenceQuarterly vendor report, Annual program review summary
TriggerEvent-driven · At each termination; retention runs seven years from it
EvidenceOffboarding checklist, Retention schedule entry