Policy, Program and Procedures

 View Only

  • 1.  Team Structure

    Posted 09-22-2020 04:28 AM
    We're a growing business spanning multiple entity/disciplines and soon to be continents and I wondered if anyone would be happy sharing their Vendor Management team, 3rd party risk and procurement structure.

    I'm mapping out all the key tasks/areas and there are many schools of thoughts about centralised teams, semi devolved, and completely devolved and would love to hear other people's thoughts and experience in this area to help shape my thoughts on what might be best for us over the coming years

    Thanks in advance


  • 2.  RE: Team Structure

    This message was posted by a user wishing to remain anonymous
    Posted 09-23-2020 08:39 AM
    This message was posted by a user wishing to remain anonymous

    Good Morning! 

    There has to be some level of centralization with Vendor Management since the information gathered as part of risk assessments should be rolled up and reported to the top decision makers in your organization. Or, to an Enterprise Risk function that can do the same thing. That's an important thing to keep in mind as you build out a structure. Now, how much you centralize or devolve should be based on what makes the most sense for your organization. I could see how it would be tough to have one team managing contracts and engagements that are mainly leveraged overseas. In that case, I would recommend having a semi-devolved structure with similar teams across different disciplines that conduct assessments and manage relationships, but have them operate and provide deliverables under the same structure, (policy and procedures). Then have a centralized team that holds those separate teams accountable for providing data and "roll up" deliverables which they manage and report on. 

    For example, all teams need to provide status report of all risk assessments, current risk ratings of existing vendors, and significant areas of concern (in a template power point, perhaps), on a quarterly basis. Then the centralized team would collect and report that to the board, enterprise risk committee, what have you. 

    This would be my best recommendation for what you described. I haven't actually seen this in action, but I've seen a lot TPRM setups that were painful for all involved. I think this would be a great setup. 

    Hope this helps!
    Original Message


  • 3.  RE: Team Structure

    Posted 09-23-2020 09:18 AM

    Depending on the size of the team, I think a good way to structure Vendor Management is with a "center lead" model.  Vendor Management is given organizational authority and creates the policies, processes, and best practices that everyone will use.  Additionally, I think it's a good approach to have Vendor Management be the "lead" for the strategic/critical vendors and be responsible for driving those relationships and collaborating with the affected teams.  Otherwise, based on appropriate criteria for the organization (i.e. transactional, low cost, low risk, etc.), the other areas can utilize the pre-determined procedures.     


    Original Message


  • 4.  RE: Team Structure

    Posted 10-03-2020 09:10 AM
    Precisely how you structure to deliver vendor management is based on a number of factors. While there's no one-size-fits-all answer, there are some common things you should consider in setting up your Vendor Management operating model and organizational structure:

    • Requirements - corporate mandates and executive imperatives, legal and regulatory compliance, etc. 
    • Culture - bias towards centralized or distributed/delegated accountabilities, politics
    • Organizational Alignment - stakeholder charters, goals and objectives, policies
    • Clearly defined stakeholder roles and responsibilities (vendor management, sourcing/procurement, risk, audit and compliance, legal)
    • Capabilities - people, processes, data, and technology maturity and capacity
    What is most critically important is enabling holistic governance that achieves the outcomes of vendor management: relationship management, risk management, and value realization (financial, performance, innovation).
    Original Message