Review vendors on the cadence their tier sets

Vendor Management policy, §5.5

Critical providers are reviewed at least annually with a site visit or video walkthrough and a refreshed SOC 2 or comparable attestation; material vendors annually from documentation; standard vendors at renewal or material change. Each review covers performance, financial condition, attestations, incidents, and proposed changes.

Annual

Annual for Tier 1 and 2; at renewal for Tier 3

Schedule each vendor’s review from its tier, collect the current attestation and financials, hold the walkthrough for critical providers, and record the outcome in the inventory.

• Annual review record

  Per vendor: date, reviewer, attestation received, findings, outcome

• Current SOC 2 or comparable attestation

  Report covering the current period, on file

Compliance Officer

Leela can keep each vendor’s review and attestation dates and open the review when one comes due.

Tell Leela about your company to see whether this applies.