An internal document that lays out the concepts within the policy. It should be instructive to senior management and the lines of business, setting out in detailed steps what the business units need to know and what is expected throughout the organization to appropriately manage vendors. It should be strong enough to support all the lines of business, yet flexible enough that it allows for the addition of new third parties or products.