One of your third-party vendor relationships is coming to a close. Regardless of whether the agreement you had with the vendor naturally expired (i.e. was not renewed), or was terminated early (due to breach of contract or some other contractual reason), the time has now come to say goodbye.
How prepared are you for what comes next? Oftentimes, organizations put more structure and formality on the front-end of their third-party management process (i.e. sourcing & procurement, risk & due diligence, contracting, etc…) but they don’t give enough attention to the importance of having well-defined offboarding procedures.
Here are six important tips to consider when a vendor relationship is ending.
1. Access to systems and information
Vendors are often given varying levels of access to systems throughout the duration of their contract (i.e. VPNs, network backbones, telecommunication systems, direct access to internal systems, etc…) in order to deliver the goods/services they were hired to provide. Keep a detailed log of all the systems/information your vendors have access to (and which personnel specifically have access). This type of log should be referenced during the offboarding process to ensure all identified access points to your company’s information are terminated/revoked.
2.Physical access to buildings
The nature of the work a vendor performs for your company may require that they have on-site access to your offices and/or buildings. Similar to the tip provided above about a vendor’s access to systems & information, it’s important to keep a log of the personnel who have access to your premisses, and also how they have access (i.e. key fob, building key, access codes, etc.). Once their contract expires and on-site access is no longer required, activities you should consider include 1) ensuring the vendor returns any building keyfobs and/or badges, 2) notifying pertinent staff (i.e. receptionists, security personnel, etc.) that the vendor no longer has on-site access and/or 3) updating internal systems related to building access.
3.Return of equipment/property
In cases where a vendor was lent equipment/property to perform their contractual obligations (i.e. laptop, tablet, compter peripherals, etc.), a process should be in place to ensure all equipment/property is accounted for and returned. Software (or self-generated logs) can be utilized to document, tag and identify issued, returned and missing equipment. Software/logs should also document the condition of the equipment after return and/or missing parts.
4. Contract deliverables
As with the other tips in this article, documentation is key! The path from contract start to contract completion often deviates from the terms stiputed in the original agreement. This can be due to scope changes, unplanned delays or other unforeseen circumstances. It’s imperative that, during the length of the vendor relationship, any contract deviations (specifically those that impact contract deliverables) are documented in writing. Nothing should be left to memory recollection.During the offboarding process, you should ensure that all goods or services the vendor was contracted to provide were actually delivered.
5. Final payments
During the off-boarding process, it is vital to ensure that all vendor invoices have been settled. This often goes hand in hand with Tip #4 (Contract Deliverables), since it is not uncommon for payments to be tied to milestones or deiverables (i.e. the vendor is paid once certain deliverables are received and approved).
6. Updates to the vendor profile
A best practice for any third-party risk management program is the utilization of a vendor management system. These types of systems come in all shapes and sizes (and with varying levels of functionality), but at their core is the ability to create a Vendor Profile (i.e. what is the vendor’s legal name, who are your primary points of contact, what active contracts do you have with the vendor, etc.). When a vendor relationship ends, it’s critical to ensure that the vendor’s profile is updated accordingly. Following this simple tip will allow you to keep an accurate inventory of your third-party relationships.
