Exam preparation
Preparing for a vendor management exam
An exam goes more smoothly when the record already exists. Here is what to have ready, where each piece lives in VendorRisk, and how to find the gaps before an examiner does.
Eight things to have ready
A current vendor inventory
Every third party in one register, each with a risk level and a named internal owner.
Your risk assessments
The templates you score with, and the inherent and residual risk recorded for each vendor.
Due diligence on critical vendors
Completed questionnaires with their scores, flagged answers and approvals.
Contracts and key provisions
Each agreement with its dates, notice deadlines and the provisions it contains, from a library of 40+.
Current vendor documents
SOC reports, insurance certificates and other documents, requested from vendors and tracked to expiration.
Evidence of ongoing monitoring
Scheduled performance reviews against SLAs, and a log of incidents and how they were handled.
Findings and their resolution
Each open item with an owner and a status, followed through to closure.
Committee and board oversight
Reviews routed through a committee with documented sign-off, and reports for the board.
Find the gaps before the exam
The useful question a few weeks out is which vendor records are incomplete or out of date.
-
Grade every vendor record
With vendor grading turned on, each vendor gets a letter grade from A to F, updated nightly, with a list of exactly what to fix. A program-wide view shows which items are most often missed. Vendor management → -
See what is overdue
Your dashboard groups overdue reviews, expired items and in-process reviews into tiles with counts. Dashboard → -
Chase missing documents in one pass
Use bulk actions to request updates to expiring documents across many vendors at once. Bulk actions → -
Export the evidence
Reports and vendor profiles export to Excel or PDF, ready to hand over. Reports →
Common questions
- Does VendorRisk guarantee a clean exam?
- No, and no software can. What it does is keep your vendor record complete and current, and show you where the gaps are while there is still time to close them.
- Can we export what an examiner asks for?
- Yes. Reports and vendor profiles export to Excel or PDF.
- We are still on spreadsheets and have an exam coming. Where do we start?
- Import your vendors, contracts and contacts from CSV files, then start with four modules: vendor management, contract management, due diligence reviews and risk assessments.
- Can someone help us prepare?
- Yes. Our managed services partners can help you prepare for an audit, take inventory of your vendor management process, and define policies and procedures.
Also see
Your Next Exam Starts Today
Build the vendor oversight program your regulators expect — before they ask for it.