Skip to main content
Governance Authority
Category: Third-Party and Supply Chain

Vendor Onboarding

Also known as: Supplier Onboarding
Simply put

Vendor onboarding is the process an organization follows to set up a new supplier so it can begin doing business with them. It typically involves collecting and verifying the vendor's information, checking that they meet compliance and risk requirements, and formally approving and integrating them into the organization's systems. It marks the transition of a supplier from a prospective or new party to an approved, active provider.

Formal definition

Vendor onboarding is a structured phase within the broader vendor management lifecycle in which a prospective supplier is established as an approved provider of goods, services, or technology to an organization. It generally encompasses discovering and assessing potential suppliers, collecting and verifying vendor information, conducting compliance and risk checks (such as due diligence screening), securing approval, and integrating the vendor into the organization's operational and financial systems. As a control activity, onboarding is typically owned and executed by management (for example, procurement, finance, or a third-party risk function) rather than by the board or independent assurance functions; the specific due diligence and compliance requirements applied depend on the organization's risk appetite, applicable law, sector, and the nature of the vendor relationship. This entry is educational and not legal, audit, or compliance advice.

Why it matters

Vendor onboarding is the point at which an organization's risk exposure to a third party is first established. The information gathered, the due diligence performed, and the standards applied at this stage generally shape the organization's ability to manage that relationship for its entire duration. A vendor that is onboarded without adequate verification or compliance screening can introduce financial, operational, regulatory, security, and reputational risks that are far harder and more costly to address once the party is active in the organization's systems. As a control activity, onboarding functions as a gate: it is one of the primary opportunities to prevent unsuitable or non-compliant suppliers from becoming embedded in the supply chain.

Because onboarding sits within the broader vendor management lifecycle, it also sets the baseline against which ongoing monitoring and periodic reassessment are measured. Incomplete or poorly documented onboarding can leave gaps that undermine later assurance activity, making it difficult to demonstrate that appropriate checks were performed. The rigor applied typically scales with the nature and criticality of the relationship, an organization's risk appetite, and applicable legal and sector-specific requirements, which vary by jurisdiction and entity type.

Onboarding is owned and executed by management functions such as procurement, finance, or a dedicated third-party risk team, rather than by the board or independent assurance functions. This distinction matters for accountability: the board and its committees may set expectations and oversee the framework, but responsibility for designing and operating the onboarding process itself generally rests with management. This entry is educational and not legal, audit, or compliance advice, and specific requirements depend on facts, jurisdiction, and professional judgment.

Who it's relevant to

Chief Compliance and Risk Officers
Compliance and risk leaders typically define the due diligence and screening standards that onboarding must satisfy, calibrated to the organization's risk appetite and applicable legal requirements. They rely on a robust onboarding process to prevent non-compliant or unsuitable third parties from entering the supply chain and to ensure that risk checks are performed consistently and documented adequately.
Procurement and Finance Functions
These functions generally own and execute onboarding day to day, from discovering and assessing suppliers to collecting and verifying information, securing approval, and integrating the vendor into operational and financial systems. Accountability for the operating effectiveness of the process typically sits with these management teams rather than with the board or assurance functions.
Third-Party Risk Management Teams
Where a dedicated third-party risk function exists, it commonly coordinates the risk and compliance elements of onboarding, tailoring the depth of due diligence to the criticality and nature of each vendor relationship and establishing the baseline for subsequent ongoing monitoring.
Internal Auditors and Assurance Functions
Internal audit and other independent assurance providers may review the design and operating effectiveness of the onboarding process as a control, testing whether verification and compliance checks were performed and evidenced. They provide assurance over the process but generally do not execute onboarding themselves, preserving their independence from the activity they evaluate.
Boards and Board Committees
The board and relevant committees typically exercise oversight of the third-party risk framework within which onboarding sits, including setting expectations around risk appetite. Their role is generally one of oversight rather than operational execution, and attributing the operational onboarding duty to the board would misstate where accountability sits.

Inside Vendor Onboarding

Due Diligence Screening
The pre-contract assessment of a prospective vendor's background, typically including financial stability, ownership and beneficial ownership, sanctions and watchlist checks, anti-bribery and corruption exposure, and, where relevant, data security and privacy posture. The depth of screening is generally calibrated to the risk the vendor presents rather than applied uniformly.
Risk Tiering / Categorization
The classification of vendors by risk level (for example, critical, high, medium, low) based on factors such as access to sensitive data, criticality to operations, spend, and regulatory sensitivity. Tiering determines the intensity of onboarding controls and the frequency of subsequent monitoring.
Contractual Controls
The terms embedded in the vendor agreement that allocate obligations and rights, such as confidentiality, data protection provisions, audit and inspection rights, subcontracting restrictions, service levels, and termination clauses. These translate risk expectations into enforceable commitments.
Compliance and Policy Attestations
Representations or certifications the vendor provides regarding adherence to applicable laws and the buyer's relevant policies (for example, code of conduct, anti-corruption, information security). Attestations support the compliance function's records but generally supplement rather than replace independent verification for higher-risk relationships.
Approval and Segregation of Duties
The defined workflow of reviews and sign-offs across procurement, business owners, and control functions before a vendor is activated. Separating requesting, approving, and payment-setup responsibilities is a common control to reduce fraud and conflict-of-interest risk.
Master Data Setup
The creation of the vendor's record in procurement and payment systems, including banking details and tax information, with verification steps to guard against payment fraud and duplicate or fictitious vendors.
Ongoing Monitoring Linkage
The connection between onboarding and the continuing management of the relationship, including scheduled re-screening, performance and control reviews, and triggers for reassessment. Onboarding establishes the baseline against which residual risk is subsequently managed.

Common questions

Answers to the questions practitioners most commonly ask about Vendor Onboarding.

Is vendor onboarding just a procurement task, or does it involve governance and compliance?
Vendor onboarding is often mistaken for a purely procurement or purchasing activity, but in most mature programs it is a cross-functional process. Procurement typically owns the commercial and contracting workflow, while compliance, risk, legal, information security, and sometimes internal audit contribute to due diligence, screening, and control requirements. Which function owns which step varies by organization, but treating onboarding as procurement alone tends to leave third-party risks such as sanctions exposure, data protection obligations, or conflicts of interest inadequately assessed. Accountability for the overall framework generally sits with management, with the board or a relevant committee providing oversight rather than performing the onboarding itself. This entry is educational and not legal, audit, or compliance advice.
Does completing vendor onboarding mean the vendor has been fully assessed and no further monitoring is needed?
No. Onboarding is generally a point-in-time process that establishes a baseline before or at the start of a relationship, whereas third-party risk typically evolves over time. Completing onboarding does not eliminate the need for ongoing monitoring, periodic re-screening, or reassessment when circumstances change, such as a shift in the services provided, the vendor's ownership, or its geographic footprint. In many programs, the depth of ongoing monitoring is calibrated to the vendor's risk tier. Confusing a completed onboarding checklist with continuous assurance is a common gap. The specific monitoring cadence and triggers depend on the organization's risk appetite, sector, and applicable requirements, and should reflect professional judgment.
How should an organization decide the level of due diligence a new vendor requires?
Many programs apply a risk-based, tiered approach rather than a single standard for every vendor. Tiering is typically driven by factors such as the criticality of the goods or services, access to sensitive or personal data, the vendor's geographic and sanctions exposure, financial dependency, and the potential impact of a vendor failure. Higher-risk relationships generally warrant enhanced due diligence, while lower-risk vendors may follow a streamlined process. The criteria and thresholds should reflect the organization's risk appetite and tolerance, and applicable regulatory expectations, which vary by jurisdiction, sector, and entity type. Documenting the rationale for each tier helps support consistency and demonstrate diligence.
Which functions should be involved in the vendor onboarding workflow?
The functions involved typically depend on the nature and risk of the vendor, but common contributors include procurement or sourcing for commercial terms, legal for contracting, compliance for screening and integrity checks, information security and privacy for data-related risks, finance for financial stability and payment controls, and the business owner who will manage the relationship. Assurance functions such as internal audit generally review the effectiveness of the onboarding framework rather than participating in individual onboardings, to preserve independence. Clarifying who owns each step and where accountability sits helps avoid gaps where a risk falls between functions. Roles and structures vary by organization.
What controls are commonly built into a vendor onboarding process?
Controls frequently seen in onboarding include verifying the vendor's legal identity and beneficial ownership, screening against sanctions and watchlists, checks relevant to anti-bribery and conflicts of interest, financial viability review, information security and data protection assessments, and validation of required licenses or certifications where applicable. Contractual controls such as audit rights, data protection clauses, and defined service levels are also common. When evaluating these controls, it is useful to distinguish control design from operating effectiveness: a well-designed control still needs evidence that it operates as intended over time. The appropriate mix of controls depends on the vendor's risk profile and applicable obligations.
How can an organization document vendor onboarding to support audit and oversight?
Documentation generally aims to create a traceable record of the decisions and checks performed, so that both assurance functions and, where relevant, regulators can understand what was assessed and why. This often includes the risk tier assigned and its rationale, evidence of screening and due diligence completed, sign-offs by the relevant functions and business owner, identified issues and how they were resolved or accepted, and the resulting contractual terms. Clear ownership of records and retention aligned to policy and any applicable requirements supports later review. The specific expectations for documentation vary by jurisdiction, sector, and framework, and organizations should apply their own judgment. This is educational information, not audit or compliance advice.

Common misconceptions

Vendor onboarding is a procurement administrative task, so ownership sits with procurement alone.
Procurement typically operates the onboarding process, but accountability is generally shared. The business owner usually owns the underlying risk decision, while compliance, information security, privacy, and legal contribute specialist assurance. Under a three-lines model, the first line owns and manages the risk while assurance functions provide oversight; treating onboarding as a single-function activity can leave risks unowned.
Once a vendor passes onboarding due diligence, the risk has been addressed.
Onboarding assesses risk at a point in time and establishes controls, but it addresses inherent risk only to the extent controls are designed and operating effectively. Residual risk remains and can change as the vendor's circumstances, the services, or the regulatory environment evolve, which is why onboarding is generally paired with ongoing monitoring and periodic reassessment.
A vendor's own attestation of compliance is sufficient evidence that controls are effective.
An attestation reflects the vendor's representation and speaks to control design or intent more than to operating effectiveness. For higher-risk vendors, practitioners generally seek independent evidence such as third-party audit reports, certifications, or audit-right exercises, calibrated to risk tier and the requirements applicable to the entity and sector.

Best practices

Calibrate onboarding depth to a documented risk tier rather than applying a uniform checklist, so that critical and high-risk vendors receive proportionately deeper due diligence and contractual controls.
Define and document ownership across the process, clarifying which function operates the workflow, which owner accepts the residual risk, and which assurance functions must sign off before activation.
Embed enforceable contractual controls, such as audit rights, data protection terms, subcontracting limits, and termination provisions, that reflect the vendor's risk tier and the applicable legal and regulatory requirements.
Verify master data and banking details through an independent channel and enforce segregation of duties between requesting, approving, and payment setup to reduce fraud and duplicate-vendor risk.
Distinguish vendor attestations from independent evidence, and for higher-risk relationships require third-party reports or certifications that speak to operating effectiveness, not just control design.
Link onboarding to ongoing monitoring by setting re-screening frequency, reassessment triggers, and a defined baseline at the point of activation, recognizing that this is educational guidance and not legal, audit, or compliance advice for any specific situation.