How to use: adapt this template to your organisation's jurisdictions, sector, risk appetite and delegation of authority. Assign accountable owners and obtain legal or specialist review where required.
1. Purpose
This policy establishes proportionate, documented controls before a vendor is activated and throughout the relationship.
2. Scope
It applies to vendors, suppliers, contractors, consultants and other third parties defined by the organisation.
3. Accountability
Procurement owns the process; business owners justify need; specialist functions review applicable risk; authorised approvers own decisions.
4. Segmentation
Every vendor receives an inherent-risk tier based on service, criticality, spend, geography, access, regulation and substitutability.
5. Evidence
Required evidence must have an identified source, owner, validity period and verification method.
6. Approval
Activation requires complete mandatory checks and approval under the delegation-of-authority matrix. Material decisions remain attributable to people.
7. Exceptions
Exceptions require rationale, accountable owner, compensating controls, expiry date and approval at the required authority level.
8. Monitoring
Vendor status, evidence expiry, ownership, incidents and material scope changes trigger proportionate review.
9. Offboarding
Access, open obligations, records, retention, deletion and system status must be controlled when the relationship ends.
Related: Vendor onboarding policy guide · Risk-tiering framework · Vendor master governance