Introduction

For the better part of the 2010s, I was the General Counsel at rapidly accelerating startups. And not just any employee—I was an early employee, which means I built processes from scratch. Not surprisingly, these startups did not have a vendor management process in place. So, guess what? I built them.

Let me ask you this: what are you doing for vendor management at your company? I know you can’t answer me directly (although I wish you could). But if your answer is “it's all manual,” this guide is definitely for you. If your answer is “I have a list of all the vendors we use, and that’s it,” this guide is still for you. And if you say, “We only have like 3-4 vendors,” then, my friend, I don’t think you fully grasp what vendor management really is.

Spoiler alert: If you’re still managing your vendors through spreadsheets with zero automation, you're in the right place. Let’s dig in.

Vendor Management 101: What You Need to Know

When I say "vendor," I mean any company that provides your business with a service. It doesn’t matter if they process sensitive data or just organize your Friday lunch orders. This is where some people make a big mistake—they think they can narrow down their vendor list based on who handles sensitive data. Wrong move! Trust me, your vendor risk is much bigger than just your cloud provider (I’m looking at you, "I-only-use-AWS" crowd).

3 Critical Steps to Build Your Vendor Management Program

Step 1: Determine Your Company’s Risk Categories

Let's be real. Not every vendor is created equal. Some are holding the keys to your kingdom (e.g. payroll providers), while others are harmless, like the vendor who organizes the Friday lunch.

Break it down into three risk categories:

• Low Risk: Vendors handling public data (e.g., website content, Canva designs).
• Medium Risk: Vendors handling confidential data (e.g., sales prospecting data from LinkedIn).
• High Risk: Vendors handling sensitive data (e.g., employee social security numbers, payroll services, customer data).

Step 2: Build and Organize Your Vendor List

This is where the fun begins. Start with accounts payable to get the list of all vendors your company is paying. Then, find your "shadow IT" vendors—those sneaky little tools your team uses but don’t show up in formal payment channels.

You might be thinking, “This sounds like a lot of work,” but it’s not that bad. At ClearOPS, we hit 40 vendors before we even launched our product, and we’re not a massive company. Get yourself a vendor management tool to help out (shameless plug: we built one for you) or start with Excel—just be warned, spreadsheets are easy to lose track of and infrequently update.

Step 3: Assign the Appropriate Due Diligence for Each Vendor

Let’s not reinvent the wheel. Assign due diligence based on risk levels. Here’s a quick cheat sheet:

‍

As you can see, the secret to streamlined vendor management isn’t cutting the number of vendors you monitor. It’s about assigning the right level of due diligence based on risk. Please, don’t put every vendor through the same rigorous checks—overkill!

Best Advice – Don’t Wait!

Vendor management is that thing you set aside for “later,” only to find it looming larger and larger the more you ignore it. With every new hire and every new tool, your vendor list grows, and suddenly, you’re managing 150 vendors with a spreadsheet (trust me, you don’t want that).

Get ahead of it now. If nothing else, start an Excel list, use Dropbox to store documents, or—better yet—explore tools that automate this process. (Hint: ClearOPS has your back) Vendor management tools help send questionnaires, track approvals and monitor vendor status changes, ensuring you don’t have to manually chase down information when you should be focused on business.

In Conclusion: Don’t Wait to Start Vendor Management

Vendor management is mandatory, but it doesn’t have to be a headache. Set up your process now, make it a habit. You will thank me and yourself. Seriously, your future self will owe you one.

Pro Tip: Use ClearOPS to automate vendor monitoring, and say goodbye to those clunky spreadsheets. You’ve got better things to do.

‍

‍