vendor-management

# Vendor Management

Covers the vendor lifecycle from selection to exit. Two failures dominate this
discipline: tiering vendors by spend rather than by blast radius, and losing
every point of renewal leverage to a missed notice deadline. This skill is built
around preventing both.

## When to use this skill

- **Selecting a vendor** and needing a scorecard that survives scrutiny
- **A renewal is approaching** and the notice deadline needs to be found before it passes
- **Reviewing the vendor portfolio** for concentration, risk tier coverage, and consolidation
- **Preparing a business review** with SLA performance and credits owed
- **A vendor is underperforming** and the case needs to be built on trend, not anecdote
- **Planning an exit** and needing the sequence right

## Inputs the skill expects

- For selection: weighted criteria, must-have requirements, and 0-10 scores per vendor with evidence
- For the portfolio: annual spend, category, renewal date, notice days, and auto-renew flag per vendor
- Risk inputs per vendor: data classification, business criticality, alternative availability, subprocessor use
- Internal owner per contract
- For SLA reporting: committed metrics with target, actual, direction, credit tiers, and prior-period history
- Annual contract value and the contractual credit cap

## Clarify First

Before generating, confirm these inputs. If any is unknown or vague, ASK — do not assume:

- [ ] **Is the notice deadline known, or only the renewal date?** — the notice deadline is what constrains action, and missing it removes all leverage for a full term
- [ ] **Were the scoring weights set before any vendor was scored?** — weights chosen after seeing candidates produce a justification, not a decision
- [ ] **What does this vendor actually hold or touch?** — data sensitivity and criticality drive the risk tier; spend does not
- [ ] **Which must-haves are genuinely pass/fail?** — every entry on that list eliminates a candidate, so preferences belong in the weighted criteria

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.

## Workflows

### Workflow 1 — Select a vendor

1. Agree weighted criteria and the must-have list **before** looking at any candidate. Record who agreed them and when.
2. Define anchors for each criterion — what a 10 looks like and what a 5 looks like. This is what stops the scorecard becoming post-hoc justification.
3. Score each candidate against evidence (demo, reference call, document reviewed), not impression. Note the evidence in the scorecard.
4. Run the scorer and read the stability check before the ranking. A margin under 5% is a tie — decide it on commercial terms, exit cost, or reference calls instead.
5. If the result flips when a weight moves 50%, take that criterion back to the decision owner before proceeding.

```bash
python3 business-operations/vendor-management/scripts/vendor_scorecard.py \
  --input business-operations/vendor-management/assets/sample_vendor_candidates.json \
  --format text
```

### Workflow 2 — Review the portfolio

1. Build the vendor list with renewal date, notice days, and auto-renew flag. The notice deadline is derived, and it is the date that matters.
2. Set `as_of` explicitly so the analysis is reproducible and reviewable later.
3. Run the analyser and work the urgent renewals first — anything marked LOCKED has already lost its negotiating window for this term.
4. Check concentration in both forms: single-vendor share above 25-30% is a dependency, and category HHI tells you whether you have leverage or diversification.
5. Treat every unowned contract as a future auto-renewal. Assign an owner before anything else in the report.

```bash
python3 business-operations/vendor-management/scripts/portfolio_analyzer.py \
  --input business-operations/vendor-management/assets/sample_portfolio.json \
  --format text
```

### Workflow 3 — Run an SLA review

1. Collect committed metrics with target, actual, direction, and credit tiers. Include prior periods — the trend is the argument.
2. Run the report and check credits earned against the contractual cap. Credits exceeding the cap mean the remedy structure is too weak to change behaviour.
3. Claim the credits. Unclaimed credits are the norm, and most contracts require you to ask.
4. Escalate severe breaches to the contract owner, not the account manager — the account manager cannot change the terms that caused it.
5. Carry the findings into the renewal ask: credit tiers that bite, and a termination right after repeated breach.

```bash
python3 business-operations/vendor-management/scripts/sla_report.py \
  --input business-operations/vendor-management/assets/sample_sla.json \
  --format json
```

## Decision frameworks

### Risk tiering [PROVEN]

Score data sensitivity plus business criticality, then apply modifiers.

| Data classification | Points | | Business criticality | Points |
|--------------------|--------|---|---------------------|--------|
| PHI / health | 4 | | Critical (revenue stops in hours) | 4 |
| PII | 3 | | High (core function stops in a day) | 3 |
| Financial | 3 | | Medium (productivity loss) | 2 |
| Confidential | 2 | | Low (inconvenience) | 1 |
| Internal | 1 | | | |
| Public | 0 | | | |

Modifiers: no ready alternative +2 · network access to your systems +2 ·
subprocessors +1 · non-adequate jurisdiction +1 · vendor under 20 people +1.

| Total | Tier | Core obligations |
|-------|------|------------------|
| 8+ | **Tier 1 critical** | Annual security review, quarterly business review, **tested** exit plan, SLA with credits |
| 6-7 | **Tier 2 high** | Full questionnaire at onboarding, semi-annual review, documented exit plan |
| 4-5 | **Tier 3 moderate** | Short-form questionnaire, annual review, verified data export |
| Under 4 | **Tier 4 low** | Confirm what data it touches; nothing further |

**Tier by blast radius, not spend.** The $8K tool ho