Vendor Management Life Cycle: The 6 Stages, and Who Owns Each One

The vendor management life cycle at a glance

Why sources disagree on the number of stages

This is worth resolving before anything else, because most readers arrive having already been given a different number by someone in their own organisation.

The table below maps the published models against each other. Read across a row to see what a source includes, and read down a column to see that the underlying activities barely move.

• Procurement led models split the front end. Needs definition, sourcing strategy and vendor selection become three stages rather than one, because that is where procurement does most of its work.

• Risk led models split the middle. Identify, assess and mitigate become three stages, because a third party risk function measures itself on assessment throughput.

• IT led models add transition and governance. A seven stage IT lifecycle treats the cutover to a new supplier as its own stage, which is correct when a system migration is involved and unnecessary when it is not.

• Finance led models collapse the front end. Everything before contract signature becomes one planning stage, because finance only becomes accountable once money is committed.

The practical answer: pick the model that matches who does the work in your organisation, then make sure nothing in the six activities below is unowned.

The number is a labelling decision. The gaps are the risk.

The governance layer that every stage model leaves out

The strongest published framework on this subject is not a vendor's.

It is the Interagency Guidance on Third-Party Relationships, issued jointly by the Federal Reserve, the FDIC and the Office of the Comptroller of the Currency.

It was final on 6 June 2023 and is published as OCC Bulletin 2023-17.

It names five stages: planning, due diligence and third party selection, contract negotiation, ongoing monitoring, and termination. That much looks like every other model.

What makes it different is what it names next. Three elements sit across the whole life cycle rather than inside any single stage.

• Oversight and accountability. Someone senior is answerable for the third party portfolio, and every individual relationship has a named owner. Not a team, a person.

• Independent reviews. The life cycle itself is periodically tested by someone who does not run it, to establish whether the process is actually working rather than merely documented.

• Documentation and reporting. The evidence that each stage happened exists, is current, and can be produced on request without a fire drill.

This matters more than the stage count. A life cycle with immaculate stages and no governance layer still fails, because nothing in the stages tells you who is accountable when a step is skipped or how anyone would find out.

In practice the governance layer is where almost every failure we have seen originates. The stage was not missing. It was nobody's job.

The six stages of the vendor management life cycle with the function that owns each one, and the governance layer that runs across all of them.

Two sector equivalents worth knowing. Financial entities operating in the European Union are governed by DORA, which imposes its own register and oversight requirements on third party ICT providers.

Indian regulated entities work to the Reserve Bank of India's outsourcing directions, which set comparable expectations on due diligence and monitoring.

Where this guide comes from

This is written from operating the process rather than surveying it. Three things shaped what is in here.

• What we operate. Mindsprint runs procurement and supplier operations for a multi entity global group, with more than 3,000 suppliers digitally connected across several countries. The failure patterns below are the ones we have had to fix, not a list assembled from other articles.

• What we checked. Every benchmark comes from a neutral body: APQC for cycle time, the FBI's Internet Crime Complaint Center for fraud, Ardent Partners and World Commerce and Contracting for contract value, and the Hackett Group for leakage. Stage names follow the 2023 Interagency Guidance rather than any vendor framework.

• What we left out. Software comparison, which belongs on a different page, and any stage model we could not source. Where a figure is ours rather than an independent body's, it is labelled as ours in the text.

Two limits, stated plainly. The APQC percentile spread sits behind membership, so we publish the median and the sample size and do not estimate quartiles.

And Mindsprint sells a platform that runs these stages. That is disclosed at the end rather than threaded through the guide.

Who owns the vendor life cycle, and the pain that drives it

The life cycle has no single owner, which is the root of most of its problems.

Five functions each own part of it, and the handoffs between them are where vendors go missing.

A quick self test. If you cannot name the person accountable for your largest vendor, the life cycle is not implemented, whatever the process document says.

Stage 1: Planning and needs definition

Planning is the stage most organisations skip, and skipping it is why so many vendor relationships are wrong before they begin.

The work is unglamorous. A needs assessment defines the requirement as outcomes rather than a product, sets budget and timeline, and settles criticality before any supplier is contacted.

Setting criticality up front is the part that pays. It determines how much due diligence, contract scrutiny and monitoring the relationship gets, and it is far easier to decide before a business owner has chosen a vendor.

Who owns it

The business owner who needs the service, with procurement advising. Not procurement alone, because a requirement written by procurement without the business tends to specify the wrong thing precisely.

What good looks like

• A written needs assessment with outcomes and success measures, not a product name.

• A criticality or risk tier assigned before any supplier is contacted.

• A named business owner recorded against the requirement, who stays named for the life of the relationship.

• A decision on build, buy, extend an existing contract, or do nothing.

Where it breaks

A business owner arrives at procurement with a chosen vendor and a signature deadline.

At that point every later stage is compressed, and due diligence becomes a formality rather than a decision.

Stage 2: Due diligence and vendor selection

This is the stage with the most published guidance and the widest variation in practice. It has two distinct jobs that often get merged, to the detriment of both.

Selection asks whether the vendor can do the work, usually through a request for information and then a request for proposal. Due diligence asks whether the vendor is safe to work with.

Run them in parallel, with due diligence as a gate rather than a score. A vendor that fails screening does not get a lower score. It gets removed.

Who owns it

Procurement owns selection. Risk, security and legal own their own screens and each holds a veto within their domain. The business owner scores capability and nothing else.

What to screen, by risk tier

• Financial health. Statements, credit score and, for critical suppliers, an assessment of whether they could survive losing you as a customer.

• Security posture. A completed questionnaire, current SOC 2 Type II or ISO 27001, penetration test summary, and breach history.

• Regulatory and compliance. Sector certifications, data protection obligations under GDPR or local equivalents, sanctions and denied party screening, adverse media, beneficial ownership, and anti bribery exposure.

• Business continuity. A disaster recovery plan you have actually read, with a recovery time objective you can live with.

• Fourth party risk. Which subcontractors the vendor uses, and which of them will touch your data. This is the screen most commonly missed.

Where it breaks

Due diligence run as a document collection exercise rather than an assessment.

The questionnaire comes back complete, nobody reads it, and the file exists for the auditor rather than for the decision.

Our Vendor Due Diligence Software guide covers the screening depth this stage needs, including the tooling that automates the evidence collection.

Stage 3: Contract negotiation

Contracting converts a decision into obligations. Its quality determines how much leverage you have for the next three stages, and how cleanly you can leave.

The commercial terms get the attention. The terms that decide whether the life cycle works are usually further down the document.

• Service levels with consequences. An SLA without a credit or a remedy is a statement of intent. Specify the measurement method, the reporting frequency and who calculates it.

• Audit and information rights. The right to request evidence, and to audit if necessary, without renegotiating. Without this, ongoing monitoring depends on the vendor's goodwill.

• Notice and renewal terms. Auto renewal and evergreen clauses are where money leaks quietly. Record the notice date somewhere that will alert you, not just in the contract.

• Subcontracting controls. Consent or notification requirements before the vendor introduces a fourth party who touches your data.

• Exit obligations. Data return and destruction, transition assistance, and what it costs. Negotiate the exit while you still have leverage, which is before you sign.

Contract compliance is a discipline in itself, and the gap between what a contract says and what the organisation actually buys is measurable.

Ardent Partners puts contract compliant spend at 59.5 per cent on average against 74.9 per cent for world class procurement teams.

Who owns it

Legal owns the terms, procurement owns the commercials, and the business owner signs off on the service levels they will have to live with.

Where it breaks

Signature is treated as the finish line. The obligations agreed in the contract are never extracted into anything anyone monitors, so the document becomes an archive rather than a control.

Stage 4: Vendor onboarding

Onboarding gets the least attention in published life cycle models and carries the most operational risk. It is also where the largest share of search demand on this topic sits.

It is the point at which a legal agreement becomes an operational reality: a record in your systems, a bank account you will pay, and an identity with access to your data.

All three are permanent until someone deliberately changes them, which is what makes this stage different from every other one.

It is also where the largestThe six stages of the vendor management life cycle with the function that owns each one, and the governance layer that runs across all of them.
share of search demand on this topic sits, which suggests the people doing the work already know that.

The vendor onboarding workflow, step by step

Ten steps from request to first purchase order. The sequence matters more than the tooling: every step that runs out of order creates rework.

The vendor onboarding workflow. Step six, validating bank details, is the control step that carries the fraud risk.

• Request raised. The signed contract or approved requirement triggers onboarding. Onboarding should never start from an invoice, which is how unapproved vendors enter the master file.

• Risk tier assigned. This determines which documents are required and how much verification applies. Assigning it here, not later, prevents a critical vendor being onboarded on a low risk path.

• Due diligence pack requested. A single request listing everything needed, sent once. Sequential requests are the main cause of multi week onboarding.

• Documents collected. Tax registration, banking, insurance certificates, certifications, signed policies. Collected through a portal rather than email wherever possible.

• Documents verified. Checked against the issuing source, not just received. Expiry dates recorded so the next renewal is diarised rather than discovered.

• Bank details validated. Independently confirmed through a channel that did not originate with the request. This is the control step, and the section below explains why.

• Approval. Segregation of duties applies: the person who created the record cannot be the person who approves it.

• Vendor master record created. One record, deduplicated against the existing master file, with the risk tier, owner and review date attached.

• System and portal access. Provisioned to the minimum necessary, with an expiry that matches the contract term rather than running indefinitely.

• First purchase order. The relationship is live, and the monitoring clock starts.

The vendor onboarding checklist

What to collect, and why. Scale the list to the risk tier rather than requesting everything from everyone.

How long vendor onboarding should take

APQC puts the median at 3.0 calendar days to set up a supplier in the procurement system, measured across 3,047 organisations. That is the benchmark to hold yourself against.

Most organisations that measure their own onboarding find it takes weeks rather than days, and are surprised to learn where the time goes. It is almost never approval.

• Document chasing. Sequential requests, each one waiting on the previous reply. Consolidating the request into one pack is usually the single biggest reduction available.

• Verification handoffs. The document arrives in one team's inbox and the verification sits with another, with no shared queue and no visible status.

• Duplicate checking done manually. Or not done at all, which is worse. One documented master file clean up found 5 per cent of records were duplicates and halved the count of active vendors.

• Bank validation treated as an exception. Because it is manual, it becomes the step people work around under time pressure, which is exactly the wrong step to work around.

Measure your own cycle time in calendar days from request raised to first purchase order, not from approval.

The gap between those two definitions is where most of the delay hides.

The one step where onboarding fraud happens

Almost all vendor payment fraud traces to a single control: a bank account or remittance address change accepted without documented, independently verified approval.

The scale is not theoretical. The FBI's Internet Crime Complaint Center recorded 24,768 business email compromise complaints in 2025, with more than 3 billion dollars in reported losses.

Business email compromise specifically targets organisations that make regular payments to suppliers.

The mechanics are always similar. A convincing email arrives, apparently from a known supplier, notifying a change of bank details.

Someone helpful updates the master record. The next payment run does the rest.

• Verify out of band. Confirm the change by calling a number you already held on file, never a number supplied in the request.

• Separate the duties. The person who receives the change request cannot be the person who applies it or the person who approves it.

• Log every change. Who requested, who verified, who approved, when, and against which evidence. This is also the audit trail that proves the control operated.

• Treat mid life changes exactly like onboarding. A bank change on an existing vendor is the higher risk event, because the relationship is already trusted.

Who owns it

Procurement or a vendor master data team owns the record. Finance owns the payment detail verification. Neither should own both, and that separation is the control.

Stage 5: Ongoing monitoring and performance management

This is the longest stage by far, and the one most likely to quietly stop happening.

Onboarding has a deadline. Monitoring has only a calendar entry, and calendar entries get moved.

Two distinct activities live here and they are frequently confused. Performance management asks whether the vendor is delivering what was agreed.

Risk monitoring asks whether the vendor is still safe to work with.

A vendor can score well on delivery while its financial position deteriorates, its certifications lapse or it quietly subcontracts your data to a fourth party. Performance data will not surface any of that.

• Performance management. Scorecards against contracted service levels, quarterly business reviews for material suppliers, and a corrective action plan when targets are missed repeatedly.

• Risk monitoring. Certification expiry tracking, periodic re-assessment scaled to risk tier, continuous monitoring of financial health for critical suppliers, and adverse media or sanctions screening.

• Contract compliance. Whether the organisation is buying at contracted rates and from contracted suppliers. World Commerce and Contracting puts average contract value erosion at 8.6 per cent, most of it occurring after signature.

The vendor performance scorecard

A weighted scorecard turns opinion into a number. Weight the categories to reflect what actually matters for that vendor rather than using one template for everyone.

Score each category one to five: five exceeds targets consistently and proposes improvements, four meets all targets with minor issues, three meets minimum requirements, two frequently misses and requires a corrective action plan, one is severe failure and grounds for termination.

The scorecard only works if the vendor sees it. A score kept internally is a record.

A score shared and discussed quarterly is a management tool, and it is the version that changes behaviour.

Who owns it

The category or vendor manager owns performance. Risk owns re-assessment. The business owner owns whether the service is actually meeting the need, which the scorecard does not always capture.

Where it breaks

Monitoring collapses into exception handling. Nobody reviews anything until something fails, at which point the review is a post mortem.

Our Supplier Relationship Management Software guide covers the tooling for this stage in depth.

Stage 6: Renewal or offboarding

The final stage is the one auditors ask about first and the one organisations are least able to evidence. It is also the cheapest to fix.

Renewal and offboarding are the same decision point with two outcomes, and the decision should be made deliberately rather than by default.

An auto renewal that nobody reviewed is a decision made by the calendar.

Start the renewal review well before the notice deadline, using the performance data from stage five.

If the review happens after the notice window closes, there is no decision left to make.

The offboarding checklist

• Revoke all system, network, building and portal access, including any accounts held by the vendor's subcontractors.

• Retrieve or destroy data, and obtain written confirmation of data destruction where the contract requires it.

• Recover physical assets: equipment, passes, keys, devices.

• Settle final invoices, release or reconcile any retention, and close open purchase orders.

• Deactivate the vendor master record rather than deleting it, so the payment history and audit trail survive.

• Transition knowledge and documentation to the incoming supplier or to the internal team.

• Record the reason for exit, which is the input almost nobody captures and the one that improves the next selection.

Where it breaks

Access is the recurring finding. A vendor relationship ends commercially and the credentials stay live, sometimes for years, because offboarding was owned by procurement while access was provisioned by IT.

The second recurring finding is data. Nobody can evidence that data was returned or destroyed, because the contractual obligation was never converted into a task with an owner.

What an auditor asks for at each stage

The governance layer becomes concrete at audit. Below is the evidence most commonly requested, and where it is usually missing.

The pattern is consistent. The artefact almost always exists. What is missing is the record that someone reviewed it, concluded something, and was accountable for that conclusion.

Risk tiering: how much life cycle each vendor actually needs

Applying the full six stages to every vendor is the most common reason a life cycle programme stalls.

The stationery supplier gets the same treatment as the payroll provider, the process becomes intolerable, and people route around it.

Tiering fixes this. Assign a tier at stage one, then let the tier decide the depth of every subsequent stage.

Two rules make tiering hold. Tier on the consequence of failure rather than on spend, because a low spend vendor with production access can be your highest risk.

Tier on inherent risk first, the exposure before any controls, then record the residual risk once controls are in place.

And watch concentration risk: several critical services resting on one vendor is a single point of failure the tier of each individual relationship will not show.

Review the tier at renewal, because relationships expand quietly.

Targets by industry and by vendor type

Generic service levels produce generic monitoring. The measures below are the ones that actually matter in each context, and they are worth substituting into your scorecard rather than adding to it.

By vendor type the emphasis shifts again. SaaS and cloud providers need data residency, patch deployment speed and API stability.

Professional services need intellectual property ownership, scope and budget variance, and confidentiality. Hardware suppliers need mean time between failures, field response times and long term parts availability.

Logistics partners need delivery integrity, environmental tracking for sensitive cargo, and transit visibility. Facilities and security vendors need liability insurance limits, worker background checks and health and safety compliance.

Where vendor life cycles break, and what it costs

Five failure patterns account for most of it. None of them is a missing stage. All of them are an unowned one.

• The compressed front end. A vendor is chosen before procurement is involved, so due diligence becomes documentation. The cost surfaces later as a supplier who cannot meet the service level that was never negotiated.

• The signature cliff. Contracting completes and nothing extracts the obligations into something monitored. World Commerce and Contracting puts average contract value erosion at 8.6 per cent, with the best performers just above 3 per cent and the worst above 20.

• The onboarding queue. Weeks lost to sequential document requests, with the business owner buying off contract in the meantime because the compliant route is slower than the workaround.

• Monitoring by exception. Reviews happen only after a failure. The Hackett Group found in 2025 that world class teams recorded 60 per cent less savings leakage than their peers, and the difference is review discipline rather than tooling.

• The open exit. Access left live, data unaccounted for, assets unrecovered. This is the cheapest failure to prevent and the most expensive to explain to an auditor.

The common factor is the handoff. Every one of these failures happens between two functions rather than inside one, which is precisely what the governance layer exists to catch.

How to implement the life cycle without stalling

A sequence that works, in the order that produces visible results fastest.

• Inventory first. List every active vendor with a spend figure, a contract end date and a named owner. Most organisations cannot produce this on day one, and producing it is itself a result.

• Tier the inventory. Assign risk tiers to the whole population before designing any process. This tells you how many vendors actually need the full life cycle, and the answer is usually a small minority.

• Fix onboarding next. It is the stage with a hard deadline, a measurable cycle time and a fraud control, so improvement is visible within a quarter.

• Then close the exit. Build the offboarding checklist and run it retrospectively against vendors terminated in the last two years. Expect to find live access.

• Add monitoring last. It is the stage that requires sustained discipline, so introduce it once the population is tiered and the data is trustworthy. Start with tier one vendors only.

• Name owners throughout. Every vendor gets a person, every stage gets a function, and the portfolio gets an accountable executive. Without this the rest is documentation.

Do not begin with software selection. A tool applied to an untiered vendor population with no named owners reproduces the existing mess faster.

When you are ready to tool it, our Best Vendor Management Software guide compares the platforms.

The bottom line on the vendor management life cycle

The six stages are planning, due diligence and selection, contract negotiation, onboarding, monitoring and performance, and renewal or offboarding. Whether your organisation calls that four stages or seven does not matter.

What matters is the governance layer most models omit: a named owner for every relationship, an independent review of the process itself, and documentation that can be produced without a fire drill. A regulator considers those three non negotiable.

If you fix one stage, fix onboarding. It has a measurable benchmark, it carries the fraud control, and it is where patience with the whole process is earned or lost.