The short answer
Manage a vendor lifecycle with one governed record that identifies the vendor, approved services and authority, verification evidence and dates, current contacts and payment-instruction version, work and exception history, periodic review triggers, and final access/payment offboarding. Never let an old approved state silently authorize a new identity, destination, or scope.
Operational checklist
Mark your progress, then save a working copy. Selections reset when you leave this page. A checked box is not an approval or evidence of completion.
☐
Stable vendor identity and restricted evidence references
☐
Approved service and authority scope recorded
☐
Current contact and payment versions dated
☐
Work and exception history linked
☐
Review triggers and owner assigned
☐
Sensitive changes independently verified
☐
Offboarding closes access, open work, and payment questions
0 of 7 marked
Key takeaways
- Treat onboarding as the first decision, not permanent approval.
- Version changes to identity, contacts, authority, and payment instructions.
- Close access, queued work, and payment questions during offboarding.
Give each lifecycle stage an acceptance decision
Define requested, verifying, approved for limited scope, active, review due, restricted, suspended, and offboarded states. Record who can change state and what evidence is required. A vendor may remain active for one service category while a new category awaits review.
Do not publish or broadly copy sensitive tax, insurance, identity, access, or bank records. The control record can point to restricted evidence.
Maintain one lifecycle control record
Use effective dates so a reviewer can determine which identity, contact, authority, and payment version applied to a work order.
| Stage | Decision evidence | Trigger to revisit |
|---|---|---|
| Onboarding | Identity and approved verification under policy | Incomplete or contradictory evidence |
| Activation | Approved services, geography, spend/access limits, contacts | New scope or authority request |
| Work | Assignments, acceptance, exceptions, completion history | Repeated unresolved exceptions |
| Change | Independently verified contact/payment/identity version | Any instruction change |
| Periodic review | Evidence checked date, reviewer, open questions | Expiry, policy date, or risk event |
| Offboarding | Access removed, queued work resolved, final payment reviewed | Reactivation requires a new decision |
Treat changes as new evidence events
A familiar vendor name does not validate a new email address, banking destination, ownership entity, or service authority. Use independently established channels for sensitive changes. The FBI specifically recommends independently verifying payment changes in the context of business email compromise.
Keep previous versions and their effective dates. Historical work must continue to point to the instruction and authority that applied at the time.
Close credentials as their own offboarding population
During periodic review, suspension, or offboarding, enumerate physical keys, lockbox codes, badges, portal accounts, API credentials, and other access issued through every open or historical assignment. Vendor status alone does not revoke them.
Use the vendor access credential lifecycle to record return, revocation, rotation, expiry, and verification without exposing secrets in the general vendor record.
Edge cases
- A sole proprietor incorporates: preserve the prior entity and review the new counterparty under policy.
- An emergency substitute vendor is used: record the temporary authority and retrospective review without presenting it as normal approval.
- A vendor is suspended with open work: assign continuity and access actions rather than merely changing status.
Sources and references
Follow each source to check the underlying claim. Access checks and professional review are different steps.
1. Primary source · Federal Bureau of Investigation
Business Email CompromiseIndependently verify changes to payment information through a known channel. This does not determine whether a vendor request is fraudulent.
Source checked 2026-09-18
Automated source-access check: 2026-09-18.
Continue the workflow
adding and vetting a vendorA contractor changed bank details. What should you verify?Maintenance completion acceptanceVendor access credential lifecycle for rental propertiesRevision history
2026-09-18
Initial Phase 2 operational article with an original decision artifact, explicit failure states, primary-source scope notes, and AI-assisted technical review.