How to use: adapt this template to your organisation's jurisdictions, sector, risk appetite and delegation of authority. Assign accountable owners and obtain legal or specialist review where required.
Assess your current maturity
- Is one accountable owner responsible for the onboarding policy?
- Are requirements determined by risk rather than one checklist?
- Can reviewers trace every decision to evidence?
- Are exceptions approved, time-bound and monitored?
- Are expiry and material-change events monitored?
- Are vendor-master changes controlled and auditable?
- Can integrations operate with buyer-scoped credentials?
Score one point for each consistently implemented control: 0–2 Initial, 3–4 Developing, 5–6 Managed, 7 Optimised. This is a self-assessment, not an independent certification.
Related: Vendor onboarding policy guide · Risk-tiering framework · Vendor master governance
General information only, not legal advice. Verify requirements with the relevant competent authority and qualified advisers.