Read summarized version with
Every procurement team I talk to has the same quiet problem. The vendor management process works, but only because one or two people carry it in their heads.
They know which supplier needs a signed NDA before legal will touch the contract. They know that one vendor whose insurance certificate lapsed last year and nobody caught it until the renewal. They know the exact tax form a new supplier has to submit before finance will cut a single payment. None of it is written down. And the day that person is out, the whole thing wobbles.
If you work in procurement or finance ops, you already feel this. You don’t need a textbook definition of vendor management. You want the full process laid out step by step, the way it actually runs, and a way to make it survive turnover.
I’m Yuval, founder of Glitter AI. The tool I build turns a screen recording into a step-by-step guide, and through that work I’ve watched dozens of procurement and AP teams describe this exact headache. Let me walk you through the whole lifecycle, including a closer look at the vendor onboarding process step by step. Then I’ll show you the part most guides skip: how to make the process stick.
Teach your co-workers or customers how to get stuff done – in seconds.
What the vendor management process actually is
The vendor management process is the full lifecycle of how you select, onboard, contract, monitor, and eventually exit the third parties your business depends on. It’s broader than buying things. Procurement is one transaction. Vendor management is the relationship wrapped around all of those transactions, from the first vendor you evaluate to the day you wind one down.
I find it helps to picture six stages that loop:
- Selection - find and vet the right vendor
- Onboarding - get them set up in your systems, compliant, and payable
- Contracting - agree terms, SLAs, and pricing in writing
- Performance management - track whether they actually deliver
- Risk management - monitor financial, security, and compliance exposure
- Offboarding - end the relationship cleanly when it’s time
Most teams do all six. Very few have written down how. Let’s go stage by stage.
Step 1: Vendor selection
Selection is where bad vendor relationships are prevented or created. Skip the rigor here and you pay for it for years.
A workable selection flow looks like this:
- Define the need. What problem are you solving, what’s the budget, and what does “good” look like? Tie this back to the requisition in your procurement process so the need is documented, not just verbal.
- Build a shortlist. Three to five candidates is usually enough. More than that and the evaluation drags.
- Send an RFP or RFI. Ask the same questions of every vendor so you can actually compare answers side by side.
- Score against criteria. Price matters, but so do reliability, security posture, support quality, and references. Weight them before you see the responses, not after.
- Check references and financials. A vendor that’s about to go under is a risk no discount offsets.
The single most common mistake I see: scoring criteria invented after the proposals come in, which conveniently always favor the vendor someone already wanted. Lock the rubric first.
Step 2: Vendor onboarding
Once you’ve picked a vendor, onboarding is the operational gauntlet. At most companies this stage lives entirely in one person’s head, and it’s the one that hurts most when they leave.
A good vendor onboarding process collects, in a defined order:
- Legal documents - signed NDA, master service agreement, any SOWs
- Tax and banking - W-9 or W-8, ACH or wire details, validated against the vendor master to prevent payment fraud
- Compliance artifacts - insurance certificates, SOC 2 report, data processing addendum if they touch customer data
- System setup - the vendor record created in your ERP or AP system, GL coding, approval routing, payment terms
Get the sequence wrong and you create a vendor record before legal has cleared the contract, or you approve an invoice for a supplier whose banking details were never verified. Both happen constantly. The fix is a documented, repeatable sequence, which I’ll come back to.
Teach your co-workers or customers how to get stuff done – in seconds.
Step 3: Contracting and terms
Contracting overlaps with onboarding but deserves its own attention because this is where future disputes are won or lost.
The terms worth pinning down explicitly:
- Scope and deliverables. Vague scope is the root of most vendor conflict.
- Pricing and payment terms. Net 30, net 60, volume tiers, and exactly what triggers an invoice.
- Service level agreements. Uptime, response time, quality thresholds, and what happens when they’re missed.
- Term and renewal. Auto-renew clauses are where money quietly leaks. Track every renewal date in one place.
- Termination and data return. How either side exits, and what happens to your data when they do.
Treat the SLA section as the contract that matters most operationally. It’s the thing you’ll measure the vendor against in the next stage, so write it in measurable terms, not adjectives. World Commerce & Contracting research shows that procurement contracts lose about 11% of their value after signature on average, with unmanaged clauses and missed obligations among the leading causes. A clear, measurable SLA is one of the few contractual controls that actively limits that leakage.
Step 4: Vendor performance management
A signed contract doesn’t deliver anything. Performance management is how you find out whether the vendor is actually doing what you paid for, before it becomes a crisis.
Keep it simple and consistent:
- Define a small set of KPIs per vendor. On-time delivery rate, defect or error rate, SLA adherence, responsiveness. Three to five, not twenty.
- Run a scorecard on a fixed cadence. Monthly for critical vendors, quarterly for the rest.
- Hold a business review. A short, recurring meeting with strategic vendors where the scorecard is the agenda, not small talk.
- Document issues and resolutions. A pattern of small misses is data. If it’s only in someone’s memory, it’s not.
The teams that do this well aren’t the ones with the fanciest dashboard. They’re the ones who run the same review the same way every period. That’s a documentation problem more than an analytics one.
Step 5: Vendor risk management
Risk runs in parallel with everything above. Vendor risk management is the ongoing monitoring of the exposure each third party creates, and it’s increasingly the part auditors care about most. According to the Verizon Data Breach Investigations Report, incidents involving a third party now account for about 30% of all breaches - double the rate from prior years - which is one reason regulators and auditors now treat undocumented vendor risk programs as a material gap, not just a best practice.
The categories I’d track:
- Financial risk - is the vendor solvent and stable?
- Operational risk - what breaks in your business if they fail to deliver?
- Security and data risk - what access do they have, and is their security posture still valid? Expired SOC 2 reports and lapsed insurance are the classic gaps.
- Compliance risk - regulatory obligations, especially for vendors touching customer or financial data.
- Concentration risk - how exposed are you if a single critical vendor disappears?
Tier your vendors by criticality and apply heavier monitoring to the ones that could genuinely hurt you. A documented review schedule here is exactly the kind of evidence an audit SOP expects you to produce. “We monitor vendor risk” is not an answer an auditor accepts. “Here’s the documented quarterly review and here’s the log” is.
Step 6: Vendor offboarding
Relationships end. Contracts expire, vendors get replaced, services get brought in-house. Offboarding is the stage almost nobody documents, and it’s the one with the sharpest security and financial edges.
A clean offboarding checklist covers:
- Revoke access. System logins, API keys, building access, anything that lets them into your environment.
- Reconcile finances. Final invoices, prepaid balances, credits owed in either direction.
- Retrieve or destroy data. Get your data back, and get written confirmation theirs is destroyed per the contract.
- Deactivate the vendor record. So no one accidentally raises a PO or pays an invoice against a dead vendor.
- Capture the lessons. Why did this end, and what would you do differently next time?
Skipped offboarding is how companies end up paying a vendor they stopped using eight months ago, or leaving an old integration key live for a service that no longer exists.
Why this process keeps breaking, and the fix
Here’s the pattern across every team I’ve watched. The vendor management process isn’t missing. It exists. It just lives in the head of the one person who’s done it a hundred times. When they’re on vacation, onboarding stalls. When they quit, the next person reinvents it from scratch and reintroduces every old mistake.
The usual fix is to write a long SOP document. And the usual outcome is that the document is wrong within a quarter, because the ERP UI changed, the approval routing moved, and nobody updated the doc. Stale process documentation is almost worse than none, because people trust it and it’s lying to them.
This is the actual problem I built Glitter AI to solve. Instead of writing the vendor onboarding steps as a wall of text, you do the process once with screen recording on. Glitter turns that recording into a clean, step-by-step guide, screenshots and all, that someone can follow without you in the room. When the system changes, you re-record the part that changed instead of rewriting a document nobody enjoys maintaining.
For the vendor management process specifically, I’d document these as separate guides:
- The vendor onboarding sequence in your ERP or AP system
- The contract and renewal tracking workflow
- The performance scorecard, step by step
- The risk review, including where each artifact lives
- The full offboarding checklist with the access-revocation steps
If you want the broader philosophy on this, my guide on process documentation goes deeper on making procedures that survive turnover. The procurement SOP glossary entry covers the contracting and approval side in more detail.
Teach your co-workers or customers how to get stuff done – in seconds.
Putting it together
The vendor management process is six stages that loop: selection, onboarding, contracting, performance, risk, and offboarding. None of it is conceptually hard. The hard part is doing it consistently when the only copy of the process is in one person’s memory.
So do the work twice. Once to run the process. Once to capture it, so the next person, and the auditor, and the version of you six months from now, don’t have to guess. Map it against your existing purchase order workflow and the broader procurement process so the whole vendor lifecycle is documented end to end, not just the parts that broke loudly enough to get attention.
Yuval / Founder & CEO, Glitter AI
Frequently Asked Questions
What is the vendor management process?
The vendor management process is the full lifecycle of selecting, onboarding, contracting, monitoring, and offboarding the third-party suppliers a business relies on. It covers the entire relationship with each vendor, not just individual purchases, and is owned by procurement or finance operations.
What are the steps in the vendor management process?
The core steps are vendor selection, vendor onboarding, contracting and terms, performance management, risk management, and offboarding. These six stages form a loop that repeats throughout the life of each vendor relationship.
What is the difference between procurement and vendor management?
Procurement is the process of buying a specific good or service, focused on individual transactions. Vendor management is the broader relationship around all of those transactions with a supplier, including selection, contracts, performance, and risk over time.
What does the vendor onboarding process include?
Vendor onboarding includes collecting legal documents like NDAs and master service agreements, tax and banking details, compliance artifacts such as insurance certificates and SOC 2 reports, and setting up the vendor record in your ERP or AP system with correct GL coding and approval routing.
How do you measure vendor performance?
Define a small set of KPIs per vendor such as on-time delivery rate, defect or error rate, SLA adherence, and responsiveness. Run a scorecard on a fixed cadence, monthly for critical vendors and quarterly for others, and hold recurring business reviews using the scorecard as the agenda.
What is vendor risk management?
Vendor risk management is the ongoing monitoring of financial, operational, security, compliance, and concentration risk that each third party creates. Vendors are tiered by criticality so the suppliers that could most damage the business receive heavier and more frequent review.
What should a vendor offboarding checklist cover?
A vendor offboarding checklist should cover revoking all system and physical access, reconciling final invoices and prepaid balances, retrieving or destroying data with written confirmation, deactivating the vendor record, and capturing lessons learned for future selections.
Why does the vendor management process keep breaking?
It usually breaks because the process is undocumented and lives only in the memory of one experienced person. When that person is unavailable or leaves, onboarding stalls and the next person reinvents the process, reintroducing past mistakes.
How do you document the vendor management process so it stays current?
Instead of writing a long text SOP that goes stale, record the process being performed once and turn that recording into a step-by-step guide with screenshots. When a system changes, re-record only the affected steps rather than rewriting the whole document.
Who owns the vendor management process?
Vendor management is typically owned by procurement or finance operations, often in coordination with legal for contracts, security for risk reviews, and the business stakeholders who use each vendor. Clear ownership of each stage is what keeps the process from breaking down.
