Hello! Does anyone have a sense of benchmarks (or willing to share their own current metrics) to complete supplier onboarding? I am looking to understand the standard number of days for completing TPRM, contracting, and supplier registration in your ERP.
We have been given an expectation that 80% of all suppliers are onboarded (again, through TPRM, contracting, and ERP onboarding) in 30 days and trying to align that with industry goals / expectations.
TYIA for any guidance here!
There isn't really an industry standard timeline or estimate for onboarding a supplier. This is because the activities required to onboard a supplier or vendor can vary greatly. While the goal of getting 80% of suppliers onboarded within 30 days seems ideal, it also may not be realistic based on your existing resources.
Keep in mind that every supplier engagement is different and carries its own set of risks. The process of due diligence can vary dramatically depending on the quality of the supplier's documentation and the bandwidth of your internal Subject Matter Experts who must review and assess your supplier's control environment. Add to that the complexity of contract negotiations and the various stakeholders engaged in the process, and it is easy to see how the time to onboard a new supplier can easily exceed 30 days. As a side note, I have worked in several organizations that attempted to set similar onboarding expectations, and in each case, they had to change ( and extend) the timing expectations due to being unrealistic.
Still, since you have been given an expectation of 30 days, I would recommend the following:
1. Make sure that whoever is setting that expectation is fully educated on the onboarding process, what is involved, and the many reasons the process could exceed 30 days.
2. Make sure that your intake and onboarding process (including requirements) is well-documented and sets the expectation that processing times can be delayed when the process isn't followed, suppliers do not provide correct documentation, issues are discovered that require remediation, or final contract negotiation involves a lot of back and forth.
3. Clearly identify due diligence documentation requirements for the suppliers and the business owner responsible for the supplier relationship.
4. Make sure your due diligence and other TPRM requirements are based on the risk of the engagement. Keep in mind that high-risk or critical engagements are going to require the most thorough due diligence.
5. Ask for extra resources if necessary. For example, professional third-party risk management service providers can support various processes, including due diligence document collection and professional Subject Matter Expert reviews. Using these resources can help expedite the onboarding process when your internal bandwidth is low.
Those are my thoughts, but I would love to hear from other members too.