Vendor Onboarding SOP: Due Diligence, Approvals and Controls

Adding a vendor looks harmless. Someone needs a service, finds a supplier, signs an agreement and asks accounts payable to set them up. Weeks later you learn that the vendor handles customer data without a security review, that two departments bought from the same supplier on different terms or that the bank details on file belong to someone who was never your supplier at all.

Vendor onboarding is where procurement, finance, legal, security and the business meet. Done well, it protects you from financial loss, fraud, compliance trouble and operational disruption, while still moving fast enough that employees do not work around it. Done poorly, it is either a bureaucratic wall that people avoid or a free-for-all that exposes the company.

This guide gives you a complete operating procedure: how to take requests in, tier vendors by risk, run proportionate due diligence, approve, set up payment safely and keep reviewing after go-live. It is written as a template you can adapt, and it assumes you follow the structure from our guide on writing SOPs people follow. It also connects with the operations tech stack audit, since software vendors are part of your stack. This is operational guidance, not legal advice. Involve legal, finance and security professionals for your own requirements.

Goals of the procedure

A vendor onboarding SOP should achieve five things.

1. Business need is validated. Money is not spent on duplicates or unneeded services.
2. The vendor is real and legitimate. Identity and ownership are verified.
3. Risk is understood and proportionate. Greater scrutiny goes where harm could be greater.
4. Terms are approved and recorded. Contracts are reviewed by the right people.
5. Payment setup is controlled. The vendor master file is protected, since it is a prime target for fraud.

Keep the process proportionate. A one-time purchase of office supplies should not face the same scrutiny as a cloud provider that will hold your customer data. Tiering, described below, is how you achieve that.

Roles

Role	Responsibility
Requester (business owner)	States the need, owns the relationship and the outcome
Procurement or purchasing	Runs the process, sourcing, negotiation and vendor record
Finance or accounts payable	Payment setup, tax documentation, vendor master file integrity
Legal	Contract review, terms, regulatory questions
Security and privacy	Risk review for data, systems and access
Budget owner or approver	Authorizes the spend
Process owner	Keeps the SOP current and measures performance

For small companies, one person may hold several roles. The principle of separating certain duties, covered below, still applies, and it may need creative solutions such as an outside reviewer.

Step 1: Intake and business case

Everything starts with a request. Use a single intake channel, such as a form, so nothing arrives by side conversation.

Capture:

• What is being bought and why. What problem does it solve?
• Who is the business owner?
• Estimated cost, term and budget source.
• Is there an existing vendor or contract that could meet the need?
• Which systems or data will the vendor access? Will they handle personal, financial or confidential information?
• Will they work on site, or have access to premises or networks?
• Are there deadlines, such as a launch date?
• Any proposed vendor, and whether alternatives were considered.

Control: requests above a defined threshold should include more than one quote or a justification for single sourcing. Compare options on total cost and fit, not only on price.

Step 2: Risk tiering

Assign every new vendor a tier to decide how much diligence they receive. Tiers may be based on a short set of questions. A simple three-tier model:

Tier	Typical profile	Diligence level
Low	Low spend, no sensitive data, no system access, easily replaced	Basic identity and tax documentation, standard terms
Medium	Moderate spend or some operational importance, limited data access	Full documentation, contract review, security questionnaire where relevant
High	High spend, access to sensitive data or systems, critical to operations, regulated activity, or hard to replace	Deep due diligence, security and privacy review, legal review, executive approval, ongoing monitoring

Factors that raise the tier include:

• Handling of personal data, payment data or confidential information.
• Network, system or building access.
• Importance to critical operations, where failure would disrupt the business.
• Regulatory exposure, such as financial services, healthcare or government work.
• Contract size and length.
• Use of subcontractors or operation in higher-risk jurisdictions.

Record the tier and the reasoning. It guides everything that follows.

Step 3: Due diligence

Scale the checks to the tier. A reasonable menu:

Identity and legitimacy (all tiers)

• Legal name, address and registration. Verify the business exists and is in good standing, using official registries where available.
• Tax documentation. For US vendors, collect the appropriate tax form, such as a W-9, which also supports year-end information reporting where applicable. For non-US vendors, the relevant forms differ, so check with your finance or tax advisor.
• Contact verification. Confirm the vendor's contact information by an independent route, such as a phone number from the company's official website or an existing relationship, not solely from the onboarding documents.
• Ownership and beneficial owners, where relevant to your policy.
• Sanctions and restricted-party screening. Check the vendor and, as appropriate, its owners against applicable government lists. Your legal or compliance team can tell you which lists apply to you.

Financial health (medium and high)

• Review financial statements or credit information where available.
• Consider whether the vendor's stability is a risk to your operations. A critical supplier at risk of failure is a business continuity problem.
• Check for insurance coverage relevant to the work, such as general liability or professional liability, and request certificates when appropriate.

Security and privacy (as relevant)

• For vendors that touch your data or systems, use a security questionnaire and review their independent attestations or certifications, such as SOC 2 reports or ISO 27001 certificates, if they have them. Understand what the report actually covers, including scope and period.
• Ask about data location, encryption, access controls, incident notification, subcontractors and data return or deletion at the end of the relationship.
• If personal data is involved, ensure a suitable data processing agreement is in place and that the use aligns with your privacy commitments and applicable laws.
• Limit access to the minimum needed, and plan how it will be removed.

Operational and reputational (high)

• Reference checks with similar customers.
• Review of reliability, support capacity and business continuity arrangements.
• Adverse media or litigation checks, proportionate to the risk.
• For critical vendors, consider an exit plan: how would you replace them, and how long would it take?

Compliance with your standards

• Does the vendor meet any ethical, environmental or labor standards in your supplier code of conduct?
• Are there conflicts of interest? Ask the requester and approvers to disclose any personal relationship with the vendor.

Document what you checked, what you found and any accepted risks, with the name of the person who accepted them.

Step 4: Contract and terms

Contracts convert the relationship into enforceable commitments. Involve legal in proportion to the tier and the value.

Key items to review:

• Scope and deliverables, clearly defined, with acceptance criteria.
• Pricing and payment terms, including any escalation clauses, minimum commitments and penalties.
• Term, renewal and termination. Pay particular attention to automatic renewals and notice periods, and calendar them.
• Service levels and remedies, where uptime or response times matter.
• Liability, indemnification and insurance.
• Confidentiality, intellectual property and data protection.
• Security obligations and breach notification.
• Subcontracting and assignment.
• Audit rights, for high-risk vendors.
• Exit provisions, including data return and transition assistance.

Use standard templates and pre-approved clauses where possible to speed things up. Track deviations from the standard terms and who approved them.

Control: only authorized signatories may sign, according to a delegation of authority matrix that sets limits by role and amount. The requester usually should not sign a contract merely because they negotiated it.

Step 5: Approvals

Route approvals according to a clear matrix based on amount, tier and type of spend. For example:

• Budget owner approves the business need and spend.
• Procurement approves the sourcing process.
• Security and privacy approve where data or system access is involved.
• Legal approves non-standard terms.
• Finance or an executive approves above defined thresholds.

Every approval should be recorded with who, when and on what basis. Avoid verbal approvals and untracked email threads. Set service-level targets for each approval step, such as two business days, so that the process stays fast, and escalate when they are missed.

Step 6: Vendor setup and payment controls

The vendor master file is a high-value target. Fraudsters attempt to add fake vendors or alter existing bank details, often through convincing emails. Protect it carefully.

Segregation of duties.

• The person who requests or negotiates with a vendor should not be the one who creates the vendor record.
• The person who creates or changes vendor details should not be the one who approves payments to that vendor.
• A second person should review new vendors and any bank detail changes.

Bank detail verification.

• Collect bank details through a secure channel and on a signed, official form.
• Verify them through an independent call-back to a known contact, using a phone number you have verified, not one provided in the request.
• Consider using a bank account verification service where available.
• Never accept changes to bank details based solely on an email.

Data accuracy.

• Check for duplicates in the vendor master before creating a new record.
• Use consistent naming and capture the tax ID, addresses, contacts, payment terms and the assigned tier.
• Link the vendor to its contract and its owner.

Purchase order or approval before spending.

• Require purchase orders, or equivalent authorization, for spend above a defined threshold, so that invoices can be matched and unauthorized purchases surface early.

Restricted access.

• Limit who can create or edit vendor records, review the access list regularly and log all changes.

Finance should perform a periodic review of the vendor master file, looking for inactive vendors, duplicates, unusual bank details such as accounts shared across vendors and vendors that match employee details.

Step 7: Go-live and onboarding the vendor

Once approved and set up:

• Send the vendor clear instructions on how to invoice, including required information such as PO numbers, who to contact and payment terms.
• Provide access to systems only as needed, using accounts that can be disabled when the relationship ends.
• Introduce the vendor to the business owner and agree on communication, reporting and escalation paths.
• Record key dates, such as renewal and review dates, in a shared calendar.
• For software or data vendors, record the vendor in your system inventory and data map.

Step 8: Ongoing monitoring and review

Onboarding is the beginning of management, not the end.

• Performance reviews. For important vendors, hold regular reviews of delivery, quality, responsiveness and issues. Use a simple scorecard.
• Risk reviews. Reassess the tier and re-run due diligence on a schedule, such as annually for high-risk vendors. Check updated certifications, insurance and financial health.
• Contract management. Track renewals, price changes and obligations. Decide on renewals well before notice deadlines.
• Access reviews. Confirm that vendor accounts and permissions are still necessary.
• Incident handling. Define how the vendor reports problems and how you respond. Security incidents involving vendors should follow your incident response runbook.
• Spend monitoring. Compare actual spend against approved amounts and flag overruns.

Step 9: Offboarding vendors

When the relationship ends:

• Give notice according to contract terms.
• Revoke system and building access.
• Retrieve or confirm deletion of your data, and obtain written confirmation where required.
• Settle outstanding invoices and obtain final reports.
• Deactivate the vendor in the master file, so that no further payments can be made.
• Record lessons learned.

The procedure at a glance

1. INTAKE         Request submitted with business case and data/access questions
2. TIER           Assign Low / Medium / High risk tier
3. DUE DILIGENCE  Identity, tax docs, screening; financial, security, privacy as tier requires
4. CONTRACT       Review terms; authorized signatory only
5. APPROVE        Route per approval matrix; record every approval
6. SET UP         Create vendor record with dual control; verify bank details by call-back
7. GO LIVE        Share invoicing instructions; grant minimum access; calendar key dates
8. MONITOR        Performance, risk, access and contract reviews
9. OFFBOARD       Revoke access, retrieve data, deactivate vendor

Metrics

Track the process itself.

• Cycle time from request to approval, by tier.
• Percentage of vendors with complete documentation.
• Exceptions and policy deviations, and who approved them.
• Spend with unapproved or non-contracted vendors.
• Duplicate vendor records found.
• Bank detail change requests and verification completion rate.
• Overdue reviews and missed renewal notices.
• Requester satisfaction.

If cycle times are long, find the bottleneck. If people avoid the process, ask them why. A process that is slow without reason will be bypassed.

Common mistakes

One-size-fits-all. Treating every vendor the same either slows the business or understates real risks.

Letting the requester set up the vendor. This removes an essential control.

Accepting bank changes by email. This is a classic fraud route.

Ignoring renewals. Auto-renewals trap you in unwanted commitments.

No ongoing review. A vendor that was safe three years ago may not be today.

Paper-only or inbox-only records. Without a central record, you cannot answer simple questions about who you buy from.

Forgetting offboarding. Dormant access and active vendor records linger as risks.

Key takeaways

• A good vendor onboarding procedure protects against fraud, compliance failures and operational risk without making purchasing impossible.
• Tier vendors by risk so that diligence is proportionate.
• Verify identity, tax documents and bank details through independent channels, and never accept bank changes by email alone.
• Separate duties: those who request or create vendors should not approve payments to them.
• Route approvals by a documented matrix and record each one.
• Treat onboarding as the start of a lifecycle that includes monitoring, renewal management and offboarding.

A vendor process people respect is fast for simple requests, careful for risky ones and clear about why.

Sources and further reading

Links were checked on October 11, 2026. Pricing, limits and rules change, so confirm on the source before you act.

• IRS: About Form W-9. Explains that Form W-9 is how a payee gives the correct taxpayer identification number to the party who must report payments to the IRS.
• FBI IC3: Business email compromise public service announcement. Describes scams in which criminals use email accounts to trick businesses into wire transfers, and advises verifying vendor payment changes through a known phone number.