The short answer
Manage a vendor lifecycle with one governed record that identifies the vendor, approved services and authority, verification evidence and dates, current contacts and payment-instruction version, work and exception history, periodic review triggers, and final access/payment offboarding. Never let an old approved state silently authorize a new identity, destination, or scope.
Operational checklist
Mark your progress, then save a working copy. Selections reset when you leave this page. A checked box is not an approval or evidence of completion.
0 of 7 marked
Key takeaways
Give each lifecycle stage an acceptance decision
Define requested, verifying, approved for limited scope, active, review due, restricted, suspended, and offboarded states. Record who can change state and what evidence is required. A vendor may remain active for one service category while a new category awaits review.
Do not publish or broadly copy sensitive tax, insurance, identity, access, or bank records. The control record can point to restricted evidence.
Maintain one lifecycle control record
Use effective dates so a reviewer can determine which identity, contact, authority, and payment version applied to a work order.
| Stage | Decision evidence | Trigger to revisit |
|---|---|---|
| Onboarding | Identity and approved verification under policy | Incomplete or contradictory evidence |
| Activation | Approved services, geography, spend/access limits, contacts | New scope or authority request |
| Work | Assignments, acceptance, exceptions, completion history | Repeated unresolved exceptions |
| Change | Independently verified contact/payment/identity version | Any instruction change |
| Periodic review | Evidence checked date, reviewer, open questions | Expiry, policy date, or risk event |
| Offboarding | Access removed, queued work resolved, final payment reviewed | Reactivation requires a new decision |
Treat changes as new evidence events
A familiar vendor name does not validate a new email address, banking destination, ownership entity, or service authority. Use independently established channels for sensitive changes. The FBI specifically recommends independently verifying payment changes in the context of business email compromise.
Keep previous versions and their effective dates. Historical work must continue to point to the instruction and authority that applied at the time.
Close credentials as their own offboarding population
During periodic review, suspension, or offboarding, enumerate physical keys, lockbox codes, badges, portal accounts, API credentials, and other access issued through every open or historical assignment. Vendor status alone does not revoke them.
Use the vendor access credential lifecycle to record return, revocation, rotation, expiry, and verification without exposing secrets in the general vendor record.
Edge cases
Sources and references
Follow each source to check the underlying claim. Access checks and professional review are different steps.