Vendor Management

Vendor Management

Covers the vendor lifecycle from selection to exit. Two failures dominate this discipline: tiering vendors by spend rather than by blast radius, and losing every point of renewal leverage to a missed notice deadline. This skill is built around preventing both.

When to use this skill

• Selecting a vendor and needing a scorecard that survives scrutiny
• A renewal is approaching and the notice deadline needs to be found before it passes
• Reviewing the vendor portfolio for concentration, risk tier coverage, and consolidation
• Preparing a business review with SLA performance and credits owed
• A vendor is underperforming and the case needs to be built on trend, not anecdote
• Planning an exit and needing the sequence right

Inputs the skill expects

• For selection: weighted criteria, must-have requirements, and 0-10 scores per vendor with evidence
• For the portfolio: annual spend, category, renewal date, notice days, and auto-renew flag per vendor
• Risk inputs per vendor: data classification, business criticality, alternative availability, subprocessor use
• Internal owner per contract
• For SLA reporting: committed metrics with target, actual, direction, credit tiers, and prior-period history
• Annual contract value and the contractual credit cap

Clarify First

Before generating, confirm these inputs. If any is unknown or vague, ASK — do not assume:

• Is the notice deadline known, or only the renewal date? — the notice deadline is what constrains action, and missing it removes all leverage for a full term
• Were the scoring weights set before any vendor was scored? — weights chosen after seeing candidates produce a justification, not a decision
• What does this vendor actually hold or touch? — data sensitivity and criticality drive the risk tier; spend does not
• Which must-haves are genuinely pass/fail? — every entry on that list eliminates a candidate, so preferences belong in the weighted criteria

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.

Workflows

Workflow 1 — Select a vendor

1. Agree weighted criteria and the must-have list before looking at any candidate. Record who agreed them and when.
2. Define anchors for each criterion — what a 10 looks like and what a 5 looks like. This is what stops the scorecard becoming post-hoc justification.
3. Score each candidate against evidence (demo, reference call, document reviewed), not impression. Note the evidence in the scorecard.
4. Run the scorer and read the stability check before the ranking. A margin under 5% is a tie — decide it on commercial terms, exit cost, or reference calls instead.
5. If the result flips when a weight moves 50%, take that criterion back to the decision owner before proceeding.

python3 business-operations/vendor-management/scripts/vendor_scorecard.py \
  --input business-operations/vendor-management/assets/sample_vendor_candidates.json \
  --format text

Workflow 2 — Review the portfolio

1. Build the vendor list with renewal date, notice days, and auto-renew flag. The notice deadline is derived, and it is the date that matters.
2. Set as_of explicitly so the analysis is reproducible and reviewable later.
3. Run the analyser and work the urgent renewals first — anything marked LOCKED has already lost its negotiating window for this term.
4. Check concentration in both forms: single-vendor share above 25-30% is a dependency, and category HHI tells you whether you have leverage or diversification.
5. Treat every unowned contract as a future auto-renewal. Assign an owner before anything else in the report.

python3 business-operations/vendor-management/scripts/portfolio_analyzer.py \
  --input business-operations/vendor-management/assets/sample_portfolio.json \
  --format text

Workflow 3 — Run an SLA review

1. Collect committed metrics with target, actual, direction, and credit tiers. Include prior periods — the trend is the argument.
2. Run the report and check credits earned against the contractual cap. Credits exceeding the cap mean the remedy structure is too weak to change behaviour.
3. Claim the credits. Unclaimed credits are the norm, and most contracts require you to ask.
4. Escalate severe breaches to the contract owner, not the account manager — the account manager cannot change the terms that caused it.
5. Carry the findings into the renewal ask: credit tiers that bite, and a termination right after repeated breach.

python3 business-operations/vendor-management/scripts/sla_report.py \
  --input business-operations/vendor-management/assets/sample_sla.json \
  --format json

Decision frameworks

Risk tiering [PROVEN]

Score data sensitivity plus business criticality, then apply modifiers.

Modifiers: no ready alternative +2 · network access to your systems +2 · subprocessors +1 · non-adequate jurisdiction +1 · vendor under 20 people +1.

Tier by blast radius, not spend. The $8K tool holding your entire customer list outranks the $400K hosting contract holding nothing sensitive.

Where renewal leverage comes from [PROVEN]

Not leverage: complaining about price, threatening to leave without an alternative, escalating without a specific ask, or loyalty — long tenure lowers vendor risk, which is why tenured accounts are often priced higher.

Renewal calendar [PROVEN]

Serving notice is not leaving — it converts an auto-renewal into a negotiation.