Policy, Program and Procedures

I am curious if your vendor management function sits under IT or Risk. We currently have it under IT, as the majority of our critical and significant vendors are IT related.

I would appreciate it if you could share which department your vendor management program reports to.

Hello, currently our FI's vendor risk administrator currently rolls up to Information Security, which reports to our VP of Risk Management.

I am curious if your vendor management function sits under IT or Risk. We currently have it under IT, as the majority of our critical and significant vendors are IT related.

I would appreciate it if you could share which department your vendor management program reports to.

Good morning - Our TPVM program is part of our Enterprise Risk Management which rolls up to our Director - Risk Management and our Chief Risk Officer. We do partner with IT GRC when completing DDs. 

Hello, currently our FI's vendor risk administrator currently rolls up to Information Security, which reports to our VP of Risk Management.

I am curious if your vendor management function sits under IT or Risk. We currently have it under IT, as the majority of our critical and significant vendors are IT related.

I would appreciate it if you could share which department your vendor management program reports to.

I am curious if your vendor management function sits under IT or Risk. We currently have it under IT, as the majority of our critical and significant vendors are IT related.

I would appreciate it if you could share which department your vendor management program reports to.

I am curious if your vendor management function sits under IT or Risk. We currently have it under IT, as the majority of our critical and significant vendors are IT related.

I would appreciate it if you could share which department your vendor management program reports to.

TPRM needs to be independent of the first line in order to appropriately credibly challenge without undue infliuence. We report to the Chief Risk Officer. 

I am curious if your vendor management function sits under IT or Risk. We currently have it under IT, as the majority of our critical and significant vendors are IT related.

I would appreciate it if you could share which department your vendor management program reports to.

I am curious if your vendor management function sits under IT or Risk. We currently have it under IT, as the majority of our critical and significant vendors are IT related.

I would appreciate it if you could share which department your vendor management program reports to.

Original Message:
Sent: 5/28/2025 4:36:00 PM
From: Anonymous Member
Subject: Banking - which department does your vendor management program report to?

This message was posted by a user wishing to remain anonymous

I am curious if your vendor management function sits under IT or Risk. We currently have it under IT, as the majority of our critical and significant vendors are IT related.

I would appreciate it if you could share which department your vendor management program reports to.

Original Message:
Sent: 5/28/2025 4:36:00 PM
From: Anonymous Member
Subject: Banking - which department does your vendor management program report to?

This message was posted by a user wishing to remain anonymous

I am curious if your vendor management function sits under IT or Risk. We currently have it under IT, as the majority of our critical and significant vendors are IT related.

I would appreciate it if you could share which department your vendor management program reports to.

I am curious if your vendor management function sits under IT or Risk. We currently have it under IT, as the majority of our critical and significant vendors are IT related.

I would appreciate it if you could share which department your vendor management program reports to.

It depends on the industry sector.

In financial services, regulators prefer separation of duties between program execution and program oversight. Program execution is most often attached to the procurement function. Alternatively, in smaller FI's it is part of IT or Finance. Oversight (policy ownership, receivers of risk reporting, etc) are universally in a risk function, Ops Risk if there is one. 

Outside of financial services, it may be part of procurement, IT, legal or finance. There are no clear cut rules in the absence of regulatory oversight.

Hope this is helpful.

I am curious if your vendor management function sits under IT or Risk. We currently have it under IT, as the majority of our critical and significant vendors are IT related.

I would appreciate it if you could share which department your vendor management program reports to.

I am curious if your vendor management function sits under IT or Risk. We currently have it under IT, as the majority of our critical and significant vendors are IT related.

I would appreciate it if you could share which department your vendor management program reports to.

Our TPRM rolls up to our CFO. We have individuals involved with audit/risk, information security, and IT involved with the day-to-day management process, none of which report directly to the CFO.

I am curious if your vendor management function sits under IT or Risk. We currently have it under IT, as the majority of our critical and significant vendors are IT related.

I would appreciate it if you could share which department your vendor management program reports to.

I am curious if your vendor management function sits under IT or Risk. We currently have it under IT, as the majority of our critical and significant vendors are IT related.

I would appreciate it if you could share which department your vendor management program reports to.

I am curious if your vendor management function sits under IT or Risk. We currently have it under IT, as the majority of our critical and significant vendors are IT related.

I would appreciate it if you could share which department your vendor management program reports to.