Vendor Management: Getting the Value a Contract Promised

Key Takeaways

• Vendor management covers the supplier relationship after selection: onboarding, performance, relationship, risk, and renewal or exit.
• Not every supplier deserves the same attention. Segment suppliers by how important and how hard to replace they are, and manage each segment differently.
• Measure suppliers against what the contract specifies, on a scorecard both sides recognize.
• Supplier risk includes the supplier's own suppliers. For critical suppliers, map beyond the first tier.
• Technology vendors need extra attention: data access, security, lock-in, and many small subscriptions that nobody owns.
• Anchor vendor management to the business capabilities each vendor supports, so the impact of a failing vendor is visible before it happens.

What Is Vendor Management?

Vendor management, also called supplier management or supplier relationship management, is the ongoing work of getting value from suppliers and limiting the risk they bring.

"Vendor" and "supplier" are generally used interchangeably. Some organizations reserve "vendor" for suppliers of goods and software and "supplier" for direct materials, but the discipline is the same.

The distinction that matters is between choosing a supplier and managing one. Procurement's sourcing work ends with a contract. Vendor management starts there and covers the whole relationship: getting the supplier set up, checking that it delivers what the contract says, working with it to improve, watching for signs of trouble, and deciding at the end whether to renew, renegotiate or leave.

In Capstera's Supply Chain Management capability model, vendor management corresponds to four capabilities in the Sourcing and Procurement branch: supplier qualification and onboarding, supplier performance and relationship management, supplier collaboration, and supplier risk management. Contract management sits alongside them, because the contract is what performance is measured against.

The Vendor Management Lifecycle

A supplier relationship passes through predictable stages. Most problems come from a stage that was skipped.

1. Qualify. Before a supplier is used, confirm it can meet the requirements: financial health, capacity, quality, security and responsible sourcing, in proportion to the risk of what it will supply.
2. Onboard. Set up accurate supplier master data, payment details and access, and introduce the people who will work together. Errors here, such as duplicate supplier records, cause problems for years.
3. Contract and set expectations. Make sure the contract's service levels, prices and obligations are known to the people who will manage the supplier, not only to the people who negotiated it.
4. Measure. Report performance against the contract on a regular cycle, using data both sides accept.
5. Develop and collaborate. For important suppliers, share forecasts and plans, run joint improvement work and hold regular business reviews.
6. Monitor risk. Watch for changes in financial health, delivery, security posture, ownership and the supplier's own supply base.
7. Renew, renegotiate or exit. Decide on evidence well before the contract ends, and plan any exit so the capability the supplier supports keeps running.

Segmenting Vendors: Not Every Supplier Deserves the Same Attention

An organization may have thousands of suppliers and a vendor management team of a few people. Segmentation decides where attention goes.

The best-known tool is the matrix Peter Kraljic proposed in a 1983 Harvard Business Review article, "Purchasing Must Become Supply Management." It classifies purchases by two factors: their impact on profit, and the supply risk, meaning how hard they would be to replace. That gives four quadrants, each managed differently.

A capability lens adds a third factor: which business capabilities a supplier supports, and how important those capabilities are to the strategy. A modest software supplier may be minor by spending and still critical if it runs the only system behind claims adjudication or order promising. That supplier belongs in the strategic or bottleneck group, whatever the invoice size suggests.

Measuring Vendor Performance

A supplier scorecard turns the relationship into evidence. It should measure what the contract promised, and be read by both sides.

Good scorecards are short and stable. Four to six measures, defined in the contract or agreed at onboarding, reported on a fixed cycle from data both sides accept. Typical dimensions are delivery, quality, cost, responsiveness and, for service and technology vendors, service levels and security. Each measure needs a definition card like any other KPI: formula, data source, frequency and target, so that a review discusses performance rather than whose number is right.

The scorecard is the input to the business review, not a substitute for it. For strategic suppliers, a quarterly review covers performance, improvement actions, upcoming changes on both sides and risks. For non-critical suppliers, an exception report may be enough.

Vendor Risk Management

Supplier risk is the possibility that a supplier fails to deliver, delivers something harmful, or exposes the organization to a problem of its own.

The categories are familiar: financial failure, operational disruption, quality failures, information security and data protection, reputational issues arising from a supplier's conduct, and concentration, when too much depends on one supplier or one location. The less familiar point is that much of the risk sits beyond the first tier. A supplier may be sound while its sole source for a critical component is not. For critical suppliers, mapping the supply base beyond the first tier is the only way to see that.

Proportion matters. A full assessment of every supplier is neither possible nor useful. Tie the depth of assessment to the segment and to the capabilities the supplier supports: thorough and recurring for strategic and bottleneck suppliers, light for non-critical ones. Then make sure each high-risk supplier has a mitigation plan and an owner, whether that is an alternate source, a buffer, an exit plan or contract protections.

IT Vendor Management

Technology vendors deserve special attention, and they are often the ones managed least.

Three things make technology vendors different. They often have access to the organization's data and systems, so their security posture becomes part of the organization's own. Switching them can be slow and expensive, because data, integrations and people's skills are tied to the product. And software-as-a-service has made it easy for teams to sign up for tools directly, so an organization can accumulate many small subscriptions that procurement never saw and nobody manages.

Many organizations respond with a vendor management office for technology: a small team that keeps the inventory of technology vendors and contracts, tracks renewals, runs performance and risk reviews for the important ones, and works with architecture to avoid buying a second product for a capability that is already covered.

That last point is where business architecture helps most. When each technology vendor is mapped to the capabilities its products support, the organization can see overlaps (three tools for the same capability), single points of failure (one vendor behind several critical capabilities), and the true impact of a vendor's failure or price rise before it happens.

A Worked Example: A Software Vendor That Mattered More Than Its Invoice

An illustrative example. The company and vendors are invented to show how a capability view changes vendor priorities.

A distributor's vendor management team segments its suppliers by annual spend. Its strategic list is made up of freight carriers, packaging suppliers and its ERP vendor. A small software company that provides the order promising engine, the system that tells customers when their order will arrive, is classed as non-critical because its annual fee is modest.

A business architecture review maps vendors to capabilities. Order Promising turns out to be supported by that one product, with no alternative and a custom integration only the vendor understands. It is also one of the capabilities the distributor's strategy depends on most, because delivery reliability is how it wins business. The vendor is reclassified as a bottleneck supplier.

The change is modest in effort and large in consequence. The contract is renegotiated to include escrow of the integration code and a longer notice period. A risk review finds that the vendor depends on one key engineer. The architecture team starts documenting the integration so another provider could take it over. None of this was visible from the spend data, and all of it was visible from the capability map.

Vendor Management and Business Architecture

The common thread: vendors deliver capabilities. Managing them through that lens makes the right priorities obvious.

Map each important vendor to the business capabilities it supports. That map answers the questions vendor management struggles with on its own: which vendors are critical regardless of spend, where the organization depends on one vendor for several capabilities, where several vendors support the same capability and could be consolidated, and what breaks if a vendor fails.

The same map helps at renewal. Instead of asking only whether the price is acceptable, the organization can ask whether the vendor still supports the capability at the maturity the strategy needs, and whether the capability's target state calls for a different kind of supplier. That turns renewal from a negotiation about price into a decision about capability.

Go further

• Procurement — The capabilities that select suppliers and set the contracts vendor management works within.
• KPI meaning — How to define supplier scorecard measures so both sides accept them.
• ERP system — Where supplier master data, contracts and orders usually live.
• Business case — Make the case for switching or consolidating vendors on capability, not price alone.

Frequently Asked Questions

What is vendor management?

Vendor management is how an organization qualifies and onboards suppliers, measures and improves their performance, manages the relationship, controls the risk that they fail to deliver, and decides when to renew, renegotiate or exit. It runs for the life of each supplier relationship.

What is the difference between vendor management and procurement?

Procurement covers deciding what to buy, selecting suppliers, negotiating contracts and placing orders. Vendor management covers the relationship after selection: onboarding, performance, collaboration, risk and renewal. They share contract management, which links the two.

What is the vendor management process?

A lifecycle: qualify the supplier, onboard it, make the contract's expectations known, measure performance, develop and collaborate with important suppliers, monitor risk, and decide on renewal, renegotiation or exit well before the contract ends.

What is the Kraljic matrix?

A way to segment purchases and suppliers, proposed by Peter Kraljic in a 1983 Harvard Business Review article, by profit impact and supply risk. Its four segments, strategic, leverage, bottleneck and non-critical, are managed differently.

What is a vendor management office?

A team, often within IT or procurement, that keeps the inventory of vendors and contracts, tracks renewals, runs performance and risk reviews for important vendors, and coordinates with architecture to avoid duplicate purchases.

What are vendor management KPIs?

Common measures include on-time delivery, quality acceptance rate, price compliance against contract, service level attainment, issue resolution time, and the share of critical suppliers with a current risk assessment.

What is vendor risk management?

Identifying and reducing the risk that a supplier fails to deliver or exposes the organization to harm: financial failure, disruption, quality problems, security and data issues, reputational issues and concentration. For critical suppliers it includes looking beyond the first tier.

How does business architecture help vendor management?

By mapping each vendor to the business capabilities it supports. That shows which vendors are critical regardless of spend, where the organization depends on one vendor for several capabilities, and where several vendors could be consolidated.

Pro Tips

• Segment suppliers by the capabilities they support as well as by spend. The most critical vendor may have one of the smallest invoices.
• Hand the contract's service levels to whoever manages the supplier, in a one-page summary, on the day it is signed.
• Set renewal decision dates well before contract expiry, so there is time to run an alternative if the answer is no.
• For technology vendors, keep the vendor inventory and the application portfolio in one place, mapped to capabilities.
• Ask strategic suppliers which of their own suppliers they cannot easily replace.