Policy, Program and Procedures

Hello,

We are a regional P&C insurance company with about 400 in-scope vendors for our vendor management program. We currently have 40 critical vendors. I have a question about the frequency of performance reviews (separate from determining criticality and vendor risk assessments).

We have determined performance reviews for our critical vendors will be required bi-annually unless they are identified as a status of "On Watch" (quarterly) or "Unsatisfactory" (monthly). I am wondering what frequency other companies have set for non-critical vendors? 

Since the KPIs for performance reviews are specific to each vendor, this process is fairly complex for 400 vendors so I want to make sure we right size this requirement for our company and our vendors.

Looking forward to hearing what others are doing or plan to do.

Thanks,

Christi Osburn

PEMCO Mutual Insurance Company

We have 4 levels of vendor, critical, high, medium and low.

• Critical are reviewed annually
• High are reviewed every 2 years
• Medium are reviewed every 3-4 years
• Low are generally not reviewed

All of that being said, all vendors are reviewed:

• As part our our due diligence process prior to an agreement being signed
• When a service is added or an existing one is changed
• At every renewal
• When we are made aware of a material change in the vendor organization

Additional reviews may be done if a vendor is acquired, makes an acquisition that may impact on our service, fails to meet defined requirements, e.g. providing an unqualified SOC report, retaining PCI certification, etc.

I hope this helps.

CK

Original Message:
Sent: 08-28-2024 01:53 PM
From: Christi Osburn
Subject: Frequency of performance reviews for non-critical vendors

Hello,

We are a regional P&C insurance company with about 400 in-scope vendors for our vendor management program. We currently have 40 critical vendors. I have a question about the frequency of performance reviews (separate from determining criticality and vendor risk assessments).

We have determined performance reviews for our critical vendors will be required bi-annually unless they are identified as a status of "On Watch" (quarterly) or "Unsatisfactory" (monthly). I am wondering what frequency other companies have set for non-critical vendors? 

Since the KPIs for performance reviews are specific to each vendor, this process is fairly complex for 400 vendors so I want to make sure we right size this requirement for our company and our vendors.

Looking forward to hearing what others are doing or plan to do.

Thanks,

Christi Osburn

PEMCO Mutual Insurance Company

Original Message:
Sent: 8/28/2024 6:57:00 PM
From: Anonymous Member
Subject: RE: Frequency of performance reviews for non-critical vendors

This message was posted by a user wishing to remain anonymous

We have 4 levels of vendor, critical, high, medium and low.

• Critical are reviewed annually
• High are reviewed every 2 years
• Medium are reviewed every 3-4 years
• Low are generally not reviewed

All of that being said, all vendors are reviewed:

• As part our our due diligence process prior to an agreement being signed
• When a service is added or an existing one is changed
• At every renewal
• When we are made aware of a material change in the vendor organization

Additional reviews may be done if a vendor is acquired, makes an acquisition that may impact on our service, fails to meet defined requirements, e.g. providing an unqualified SOC report, retaining PCI certification, etc.

I hope this helps.

CK

Original Message:
Sent: 08-28-2024 01:53 PM
From: Christi Osburn
Subject: Frequency of performance reviews for non-critical vendors

Hello,

We are a regional P&C insurance company with about 400 in-scope vendors for our vendor management program. We currently have 40 critical vendors. I have a question about the frequency of performance reviews (separate from determining criticality and vendor risk assessments).

We have determined performance reviews for our critical vendors will be required bi-annually unless they are identified as a status of "On Watch" (quarterly) or "Unsatisfactory" (monthly). I am wondering what frequency other companies have set for non-critical vendors? 

Since the KPIs for performance reviews are specific to each vendor, this process is fairly complex for 400 vendors so I want to make sure we right size this requirement for our company and our vendors.

Looking forward to hearing what others are doing or plan to do.

Thanks,

Christi Osburn

PEMCO Mutual Insurance Company