Vendor Management
VM-02Classify every vendor into a risk tier
How Leela would run itEvent-driven · at engagement, at each annual review, and on material change
From the policy libraryThe requirement
Each provider is placed in Tier 1, 2, or 3 at the start of the engagement from its data access, its role in the program, and its potential effect on the sponsor bank, with the rationale documented, and re-evaluated at each annual review or material change.
- Applies
- Tell Leela about your company to see whether this applies.
- Status
- Setup needed
Tell Leela how you handle it today, or hand it over: see what’s next.
The work
Assess data access, program role, and reputational exposure, assign the tier, record the rationale, and adjust it if the sponsor bank asks.
What Leela keepsThe evidence this obligation leaves, as the work happens
Listed from the policy libraryContents
- 01Tier assignmentTier, criteria, rationale, approver, date in the inventory
Evidence
Tier assignment
Vendor Management §4
1
of 1 record
The work and the records come from this obligation in the policy library.