Classify every vendor into a risk tier

Vendor Management policy, §4

Each provider is placed in Tier 1, 2, or 3 at the start of the engagement from its data access, its role in the program, and its potential effect on the sponsor bank, with the rationale documented, and re-evaluated at each annual review or material change.

Event-driven

At engagement, at each annual review, and on material change

Assess data access, program role, and reputational exposure, assign the tier, record the rationale, and adjust it if the sponsor bank asks.

• Tier assignment

  Tier, criteria, rationale, approver, date in the inventory

Compliance Officer

Leela can propose a tier from the vendor’s data access and function for the officer to confirm.

Tell Leela about your company to see whether this applies.