What is Vendor Evaluation

SOP-OPS-042: Vendor Evaluation and Selection Framework

1. Document Control Block

• Document ID: SOP-OPS-042
• Effective Date: 2023-10-27
• Version: 1.0.4
• Review Cadence: Annual
• Target Audience: Procurement, Legal, InfoSec, Finance, and Department Heads

---

2. Executive Summary & Scope

This SOP defines the institutional standard for "Vendor Evaluation"—the systematic process of screening, assessing, and qualifying external entities to supply goods or services to Template Registry. This procedure ensures adherence to ISO 9001:2015 quality management standards and SOC2 Type II data security compliance. Scope encompasses all third-party engagements involving fiscal expenditure exceeding $5,000 USD or access to proprietary systems.

---

3. Prerequisites & Tool Requirements

• Access: Active credentials for GRC (Governance, Risk, and Compliance) platform (e.g., Vanta, Drata).
• Documentation: Current Vendor Risk Assessment Questionnaire (VRAQ) template.
• Credentials: Procurement Officer must possess Level 2 Certification in Supply Chain Management or equivalent tenure.
• Software: CRM/ERP (NetSuite or Salesforce), Secure File Transfer Protocol (SFTP) for sensitive data exchange.

---

4. Roles & Responsibilities (RACI Matrix)

---

5. Step-by-Step Operational Procedure

Phase I: Initial Screening

• Identify business requirement and draft Statement of Work (SOW).
• Conduct preliminary market research and verify vendor reputation (Dun & Bradstreet).
• Submit Initial Vendor Intake Form to Procurement.

Phase II: Due Diligence & Risk Assessment

• Issue VRAQ to vendor for completion.
• Verify security certifications (ISO 27001, SOC2, HIPAA as applicable).
• Conduct financial stability audit (Review of last two fiscal quarters).

Phase III: Comparative Analysis

• Score vendor responses against the Weighted Evaluation Matrix (WEM).
• Perform reference checks with at least two industry peers.
• Document justification for selection vs. alternatives.

Phase IV: Final Approval

• Legal Counsel reviews Master Service Agreement (MSA).
• Secure sign-off from Department Head and Finance.
• Update Approved Vendor List (AVL) in ERP system.

---

6. Quality Assurance & Verification Criteria

• Acceptance Benchmark: A minimum score of 85/100 on the WEM is required for consideration.
• Tolerance Threshold: Zero tolerance for non-compliance with data protection clauses or negative financial stability indicators.
• Audit Checklist:
  • Signed NDA present.
  • Insurance Certificates (COI) verified for coverage adequacy.
  • Conflict of Interest declaration signed by all stakeholders.

---

7. Practical Troubleshooting Scenarios

Scenario A: Vendor Fails InfoSec Assessment

• Protocol: Immediately flag the vendor as "High Risk." Notify the vendor of specific non-compliance points. Request a Remediation Plan with a 30-day completion window. If the vendor cannot meet requirements, trigger "Disqualification Protocol" and pivot to the runner-up candidate.

Scenario B: Financial Data Inconsistencies

• Protocol: Halt the evaluation process. Request an official audit statement or a CPA-signed financial letter. Do not proceed with procurement until the Finance Department provides a written waiver or confirms the validity of the provided documentation.

Scenario C: Stakeholder Disagreement on Selection

• Protocol: Escalate to the Office of the Chief Operations Architect. Perform a "Blind Comparison" where the vendor name is redacted from the WEM, and the decision is re-evaluated based strictly on technical/financial merit.