Due Diligence and Ongoing Monitoring

Evaluate the services they will be providing and ask yourself- how critical are these services? Will there be significant disruption to operations if this vendor goes belly up? Will they be accessing restricted or confidential information or do these services tie to potentially large financial losses if the vendor messes up?  In my organization if the financial review is considered a "fail",  but the business still wants to proceed with that vendor,  we work with the business to ensure all the possible risks to the organization are detailed, and describe any mitigating controls for those risks (or document the absence of them) and present in a memo to the executive operating committee for review and approval. Then we log it as a risk acceptance which then needs to be recertified annually. Also, make sure you have a well documented exit strategy with the vendor to detail what needs to occur for an abrupt or planned termination of services.          Good Luck!