Vendor management programs are usually examined through a sample of files rather than through a policy document. The policy explains what the institution intends. The file shows what it did. That distinction decides most third-party risk findings, and it is why contract quality alone does not carry a program.
In 2023 the Federal Reserve, the FDIC and the OCC issued joint interagency guidance on third-party relationships, replacing each agency separate prior guidance with a common framework. It describes a relationship lifecycle: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination. Supervisory attention follows that structure.
This article works through what belongs in a vendor contract file at each stage, where files commonly thin out, and how institutions keep evidence current without adding a manual reporting burden. It is aimed at vendor management, procurement and first-line control owners at banks and credit unions, and it assumes the program already exists and needs its evidence to hold up rather than needing to be designed from nothing.
What a complete vendor file contains
A file is assessed as a chain. Each stage should explain the next, and the depth at every stage should be proportionate to the risk the institution assigned. A high-risk relationship with light due diligence is a finding. So is a low-risk relationship carrying the full apparatus, because it suggests the risk ranking is not being used to drive anything. Consistency between the rating and the treatment is what reviewers test.
- Planning record, why the activity is being outsourced, the risk it introduces, the assigned risk rating and the rationale behind it.
- Due diligence evidence, financial condition, control environment reports, information security posture, subcontractor reliance and legal or compliance review, dated and scoped to the rating.
- Executed contract set, the agreement with its amendments, schedules, service level exhibits and any addenda, linked as one record rather than filed separately.
- Ongoing monitoring record, performance against service levels, control report reviews, issue tracking and the evidence that someone reviewed each of them.
- Termination and contingency plan, exit triggers, data return mechanics, transition assistance and the identified alternative or in-house fallback.
The provisions inside the contract matter too, and the usual gaps are predictable: audit rights that stop at a summary report, silence on subcontractors, business continuity commitments without testing evidence, and no data return mechanism at exit. Institutions that already hold a clause inventory can answer coverage questions in minutes; those that do not commission a review each cycle. Third-party risk contract automation covers building that inventory.
Risk ratings only help if they visibly drive due diligence depth, contract provisions, monitoring frequency and reporting. When every relationship receives identical treatment regardless of rating, the rating is decorative, and a reviewer will ask what purpose it serves. Tie each rating tier to a defined set of required artifacts and let the file show the tie.
Where vendor files thin out
Files are rarely empty. They thin out in specific, recurring places, usually a year or two after onboarding when attention has moved to the next implementation. The pattern is consistent enough to audit against directly: pull ten files, check these five points, and the state of the program becomes clear without reading a policy.
- Monitoring stops after year one. Onboarding evidence is thorough and the file goes quiet. Recurring reviews need a scheduled owner, not good intentions.
- Control reports collected but not reviewed. A report in the file with no reviewer, date or issue log evidences receipt, not assessment.
- Amendments filed away from the agreement. A change to service levels or scope that is not linked to the parent record leaves the file describing a superseded arrangement.
- Subcontractor position never refreshed. Chain providers change. A due diligence snapshot from onboarding does not describe the current chain.
- Termination plan written once. Exit assumptions age quickly as data volumes and integrations grow. An untested plan is an assumption.
A five-step approach to examination-ready files
Step 1, Define the artifact set per risk tier
Write down exactly which documents a critical, high, moderate and low-risk relationship must carry, and at what refresh cadence. This converts proportionality from a principle into a checklist that a reviewer can verify and a first-line owner can actually meet.
Step 2, Link the contract record end to end
Hold the agreement, amendments, schedules and addenda as one linked record with structured fields for term, renewal, notice period and service levels. Most file gaps are really linkage failures, where the evidence exists somewhere but nothing connects it to the relationship being examined.
Step 3, Extract the provisions into a clause inventory
Run clause-level extraction to record whether audit rights, subcontractor conditions, business continuity, breach notification and data return provisions are present and what position they take. A coverage view makes remediation targeted rather than a full portfolio reread.
Step 4, Schedule monitoring as obligations
Turn each recurring duty, control report review, service level reporting, insurance certificate renewal, annual reassessment, into a dated obligation with a named owner. Monitoring that depends on someone remembering the cadence is the single most common source of a thin file.
Step 5, Test the file, not the policy
Sample files quarterly using the same method an examiner would, working from the relationship rather than from the document library. Record what was missing and fix the process that produced the gap rather than only the file you sampled.
Preparing for a third-party risk exam?
See how Aavenir links agreements, clause positions and monitoring obligations into one vendor record.
Why contract data quality decides exam speed
Examination burden concentrates in retrieval. When the institution can produce the current agreement with its amendments, the clause positions, the monitoring history and the responsible owner from one record, questions resolve in a single exchange. When those live in four systems, each question becomes a request, a search and a reconciliation, and the elapsed time itself invites further sampling. The underlying work is the same in both cases. What differs is whether the relationship exists as a structured record or as a collection of documents that happen to concern the same provider. The second version is also the version that quietly loses an amendment.
File contents by risk tier
The table shows a workable artifact set by tier. Institutions should calibrate to their own size, complexity and the criticality of the activity, but the principle holds: depth rises with rating, and every required artifact should have a named owner and a refresh cadence attached to it. The bottom row is deliberate: the qualities in it apply at every tier, because an undated or unattributed artifact evidences very little regardless of how thorough the underlying work was.
| Risk tier | Due diligence depth | Monitoring cadence | Termination planning |
|---|---|---|---|
| Critical | Full, including control reports and on-site or virtual review | Quarterly performance and issue review | Documented and periodically tested |
| High | Full documentary review with security assessment | Semi-annual review | Documented with identified alternative |
| Moderate | Targeted review of financials and controls | Annual review | Documented exit approach |
| Low | Baseline screening and contract review | Annual attestation | Standard termination terms |
| All tiers | Dated, scoped and attributed to a reviewer | Recorded as completed obligations | Refreshed on material change |
Vendor contract files are examined as narratives. The rating explains the diligence, the diligence explains the contract, the contract explains the monitoring, and the monitoring explains why the institution is comfortable. Gaps read as breaks in that chain, which is why a strong agreement with no monitoring evidence scores worse than a modest agreement with a complete record. Build the chain once as structured data, keep the recurring duties as dated obligations, and the file stays ready between exams instead of being assembled before each one. For the control testing view, see the SOX and third-party risk exam checklist.
For related guidance, see Vendor contract controls for OCC and FFIEC exam readiness, The bank’s guide to DORA ICT third-party contract terms and Complementary user entity controls in vendor contracts.
