Vendor (Third-Party) Management Policy

Inside the document

1. Inventory and ownership
2. Tiering
3. Due diligence before contract
4. Contract requirements
5. Onboarding and access
6. Ongoing monitoring
7. Supplier incidents and change
8. Offboarding and exit
9. Concentration and fourth parties

Plus document control, roles, exceptions, enforcement, review cycle and an auditor evidence checklist.

Sample clause · Due diligence before contractWhen reviewing an assurance report such as a SOC 2 Type II report or an ISO 27001 certificate, the reviewer shall confirm that the scope covers the actual service, the period is recent, the opinion is unqualified, any exceptions are understood, and the customer responsibilities listed in the report are actually in place at [Company Name].

What an auditor will check

A complete vendor register with tiers, due diligence done before signing, security terms in contracts, assurance reports actually read, and exits handled.