Vendor Evaluation Template

Standard Operating Procedure: Vendor Evaluation & Selection Framework

Document Control Block

• Document ID: TR-OPS-PROC-2024-082
• Effective Date: October 26, 2024
• Version: 1.0.4
• Review Cadence: Semi-Annual (Q2/Q4)
• Target Audience: Procurement Dept., Risk & Compliance, Legal Counsel, Department Heads.

---

1. Executive Summary & Scope

This SOP defines the institutional standard for the objective assessment, vetting, and selection of third-party vendors. The scope encompasses all non-exempt procurement activities exceeding $5,000 USD. Compliance with this directive ensures alignment with ISO 27001 data security standards, GDPR/CCPA data sovereignty requirements, and Template Registry’s fiscal risk management mandates.

2. Prerequisites & Tool Requirements

• Software Access: ERP (NetSuite/SAP), Governance Risk & Compliance (GRC) Dashboard (LogicGate or equivalent), Secure Document Repository (SharePoint/Box).
• Documentation: Active NDA, Vendor Risk Questionnaire (VRQ) template, Financial Stability Disclosure.
• Certifications: Procurement lead must hold internal 'Vendor Audit' certification or equivalent financial oversight clearance.

3. Roles & Responsibilities (RACI Matrix)

---

4. Step-by-Step Operational Procedure

Phase I: Pre-Qualification & Scoping

• Define technical requirements and service level expectations.
• Verify vendor presence on 'Approved Vendor' blacklist/watchlist.
• Issue Request for Information (RFI) to secure initial disclosure documents.

Phase II: Security & Compliance Audit

• Execute GRC risk scoring based on VRQ responses.
• Validate SOC 2 Type II or ISO 27001 certification status.
• Perform financial health check (Dun & Bradstreet or similar credit monitoring).

Phase III: Comparative Analysis & Selection

• Populate the Vendor Evaluation Matrix (VEM) with weighted criteria (Price: 30%, Quality: 30%, Security: 25%, Timeline: 15%).
• Conduct final stakeholder review session.
• Generate formal selection rationale report for audit trail.

---

5. Quality Assurance & Verification Criteria

Verification: All vendor onboarding packets must be signed off by the Compliance Lead to achieve 'Authorized' status.

---

6. Practical Troubleshooting Scenarios

Scenario A: Vendor Refuses to Provide SOC 2/Compliance Documentation.

• Protocol: Immediate suspension of the vetting process. Flag as "High Risk." Redirect inquiry to Internal Security. If documentation is not provided within 72 hours, move to "Denied" status and purge initial data collection.

Scenario B: Financial Health Check Indicates Recent Bankruptcy or High Debt-to-Equity Ratio.

• Protocol: Escalate to the Chief Financial Officer (CFO). Review must determine if the vendor is "Mission Critical." If critical, require an escrow agreement for source code/services and request a shorter payment net-terms schedule.

Scenario C: Discrepancy between SLA Promises and Legal Contract Language.

• Protocol: Procurement Lead must issue a "Contractual Alignment Request" to the vendor. Do not authorize payment or sign agreements until the master services agreement (MSA) mirrors the technical SLA definitions exactly.

---

Authorized By: Julian Vance Chief Operations Architect, Template Registry