TL;DR
A vendor management policy written for a company with no procurement function should be five clauses long and tiered on access rather than spend. The clause nearly everyone omits is the exit, and it is the one you need under pressure.
- Tier the review on what a supplier can see, not what they charge.
- Name an owner per vendor. Unowned vendors renew themselves.
- Write the exit while you still like each other.
- Ask at review whether you would choose them again today.
- Vendors holding your hardware belong inside the policy.
- Five clauses that get used beat twenty pages that do not.
When you do not need one
Four stages, and the first genuinely does not.
Under about fifteen people, a handful of tools. One person signs everything and remembers all of it. A list of suppliers is enough.
Best tools for HR Operations
Tools arriving faster than anyone tracks. Somebody discovers a subscription nobody recognises. That is the signal, and it usually arrives through a card statement rather than a process.
Suppliers touching employee data. Payroll, benefits, an equipment partner, a background check provider. Now the review question is real rather than administrative.
Customers auditing your supply chain. Your own enterprise deals start depending on how you manage third parties. The policy stops being internal hygiene.
Why a vendor management policy goes unused
The usual failure is not absence. It is length. Somebody adapts a template written for an organisation with a procurement department, and the result demands a risk assessment, a scoring matrix and two approvals for a forty pound a month tool. Nobody follows it, so everybody routes around it, and the policy becomes a document that exists rather than a control that works.
The second failure is tiering on spend. It feels objective and it is almost always wrong. A cheap scheduling tool that reads your entire calendar and a cheap stock photo subscription carry completely different exposure, and a threshold set in money cannot tell them apart.
The third is that the policy describes onboarding and stops. Choosing a supplier gets five paragraphs. Living with one gets a sentence. Leaving one gets nothing, which means the exit is negotiated at the exact moment you have least to bargain with.
Supplier relationship expectations in ISO/IEC 27001 cover the whole arrangement rather than its beginning, and third-party guidance from bodies such as the National Cyber Security Centre treats ongoing assurance and exit as part of the same discipline. A policy that is all front door reflects neither.
The five clauses worth writing
- Authority. Who can commit spend, at what level, and what needs a second signature. Two tiers is usually enough.
- Review before approval. Scaled by access: no data, business data, personal data, physical custody of assets. Each tier gets a defined check.
- Ownership. One named person per vendor, with the renewal date recorded somewhere that will remind them.
- Periodic review. Annual for high-access suppliers, at renewal for the rest, asking whether you would choose them again.
- Exit. Notice, what comes back, in what format, by when, what is deleted, and who pays to move anything physical.
Five clauses on two pages. If a manager cannot apply yours without calling someone, it will be bypassed rather than followed.
Five questions before you draft
Can you list every supplier you pay? Start from the card statements and the bank, not from memory. The list is always longer.
Which of them hold personal data? That subset is your actual scope, and it is usually smaller than the full list and larger than people guess.
Which hold physical property of yours? Laptops in a warehouse are an exposure that no software-shaped policy covers.
What renews automatically in the next ninety days? If you cannot answer, ownership is the clause to write first.
Have you ever exited a supplier cleanly? The memory of the last messy one tells you what your exit clause needs.
How teams run it, and the trade-offs
A spreadsheet and one approver. Best for small teams and genuinely sufficient for a long time. It struggles on renewals, because a spreadsheet does not remind anybody, and on continuity when the approver leaves.
Approval inside finance. Best for spend control and the easiest to enforce, since the payment is the choke point. It struggles on access risk, because finance sees the amount and not what the tool can read.
A vendor management tool. Best at scale and for evidencing reviews to an auditor. It struggles on adoption, since the tool only knows about suppliers somebody entered, and the shadow ones are the risk.
Security questionnaires for everything. Best for thoroughness. It struggles on proportionality and speed, and it trains people to route around the process for anything small.
Consolidating onto fewer suppliers. Disclosure: RemoAsset is owned by the same people who publish this site. It handles procurement, delivery, retrieval, storage and certified wiping across 80 or more countries, which can replace several regional equipment suppliers with one relationship to review and exit. Where it struggles: consolidation raises concentration, so the exit clause matters more rather than less, and it covers hardware logistics only. The narrow thing it changes is how many equipment suppliers you have to manage at all.
The decision table
| Situation | Scale | Setup | Primary pain | Recommended starting point |
|---|---|---|---|---|
| Few tools, one signer | Under 15 | No procurement | Nothing to control | A supplier list |
| Unrecognised subscriptions | 15 to 50 | Finance signs | No visibility | Reconcile the card statements |
| Suppliers hold staff data | 50 plus | Ops owner | No review tier | Tier on access, then review |
| Renewals surprising you | Any | Any | Nobody owns vendors | Assign owners and dates |
| Customer audits your chain | 100 plus | Security owner | No evidence of review | Record reviews, not just rules |
| Vendor holds your hardware | Any | Any | No exit written | Write the exit clause first |
What the missing exit clause costs
The first cost is bargaining power. Every term you did not agree in advance gets negotiated at the point you want to leave, which is when your position is weakest and your timeline is shortest. Suppliers know this.
The second is data you cannot retrieve. A vendor holding records in their own format, with no contractual obligation to export, can comply fully with your termination notice and leave you with nothing usable. That is not bad faith. It is an unwritten clause.
The third is specific to anyone holding your physical property, and it is the one that catches equipment vendors. Ending the contract does not move the hardware. Somebody has to pay for freight, somebody has to say where it goes, and if neither is written you discover both during the exit.
The fourth is the renewal nobody caught. An unowned contract renews for another year because no human was reminded, and the first anybody hears of it is the invoice. Across a dozen suppliers that is a real number paid for nothing anybody chose.
So the question is not whether you have a vendor policy. It is whether you could leave your three most important suppliers next quarter, and what each exit would actually involve.
The vendors holding your property
Most vendor policies are written with software in mind, and the exit clause reflects that: export the data, revoke the access, delete the records. A supplier holding boxes of laptops does not fit that shape at all.
Three questions expose whether yours covers them. Do you know how many of your devices a third party currently holds. Does your contract say who pays to move them if you leave. And can the supplier produce a list, by serial number, of what is theirs to return.
If any answer is uncertain, that supplier sits outside the policy in practice regardless of what the scope section says. The gap is not the wording; it is that nobody applied the wording to a physical relationship.
It is worth checking before the next renewal, since this is the clause that becomes expensive precisely when you want to use it. Seeing how stored devices are recorded and released is a reasonable benchmark for what to demand of any vendor holding your hardware.
See how a logistics vendor evidences its controls
Read our guide to equipment vendor contract clauses
Related reading
- Equipment vendor contract clauses
- Vendor due diligence
- Running a vendor security review
- Switching equipment vendors
- Vendor consolidation
Frequently Asked Questions
What should a vendor management policy cover?
Who can commit spend, what review a vendor needs before approval, who owns the relationship afterwards, how performance is checked, and how a supplier is exited. The last one is almost always missing, and it is the clause you need on your worst day rather than your best.
Do we need one without a procurement function?
Especially then. A procurement team is itself a control, so companies without one are relying on individual judgement at the moment of signing. A short written policy substitutes for the function and costs almost nothing, provided it is five clauses rather than twenty pages.
How much review does a small vendor need?
Scale it to access rather than to spend, which is the mistake most policies make. A cheap tool holding employee personal data deserves more scrutiny than an expensive one that holds none. Tier your review on what the supplier can see and touch, then set thresholds from there.
Who should own a vendor after signing?
A named individual, not a department. Unowned vendors renew automatically, go unreviewed and get discovered during an audit rather than during a budget cycle. The owner does not have to be senior; they have to be identifiable and reminded before the renewal date.
What belongs in a vendor exit clause?
How notice is given, what you get back, in what format, by when, and what the supplier must then delete. For a vendor holding physical assets, add who pays to move them and where they go. An exit written after the relationship sours is written from a weak position.
How often should vendors be reviewed?
Annually for anything touching personal data or holding your property, and at renewal for everything else. The useful review asks whether you would choose this supplier again today, not whether they met the contract. Those are different questions and only one of them changes decisions.
Does this cover vendors holding our hardware?
It should, and that population is routinely forgotten because the risk looks operational rather than informational. A logistics partner storing your laptops holds your property and often your employees’ home addresses, which places them firmly inside the policy rather than beside it.
