Vendor Management Beyond Onboarding: What We Watch After the Contract Is Signed

The questionnaire is the start, not the finish. Tiering, vendor grades, continuous monitoring, and reassessment — the parts of vendor management most programs skip. A regional insurer we worked with last year had 214 vendors in their register. When we asked when each one had last been reassessed, the honest answer was: at onboarding, and never again. Some of those relationships were six years old. One of them — a claims processing outfit with access to policyholder PII — had been acquired twice since the original due diligence and no longer resembled the company that had answered the questionnaire. That is the pattern we see most often. The onboarding gate gets attention. The years that follow do not. Signing the contract is where most vendor programs stop trying. In our engagements, it is where the actual work begins. The whole point of putting a program in RISKMON is to make the boring, recurring part — the reassessments, the reminders, the grade changes — happen without someone remembering to chase it. Tiering is a scoping decision, not a formality Before we send a single questionnaire, we tier. Not because a framework tells us to, but because you cannot treat a payroll processor holding bank details the same way you treat the company that ships office coffee. In RISKMON we tier on two axes: data sensitivity and operational dependence. A ve