Most vendor risk documentation fails in the same handful of ways: entries describe accounts rather than relationships, nothing carries a date or an author, the files sit where only one person can reach them, and nobody updates anything after the first pass. None of those are sophisticated failures, and all of them show up at the same moment, which is when somebody outside your business asks a question you should be able to answer from a folder.
This article is general information about documentation and recordkeeping. It is not legal, compliance or security advice. Which obligations and frameworks apply to a given business varies by organization, industry and jurisdiction, and those questions belong with a qualified professional who knows your situation.
Mistakes in what gets recorded
The content problems are the ones that make a complete-looking set of records useless.
Listing accounts instead of relationships
A line reading “monthly subscription, marketing” is a bookkeeping entry. A vendor record describes a relationship: what the company does for you, what records it can reach, who owns it internally, and what happens if it stops.
The symptom is easy to spot. If your vendor list was built by exporting recurring payments and nothing was added to it, you have a payments report with a different title. Payments are a good place to start the list and a bad place to stop, because the vendors that matter most are often cheap or free, and the ones built on a personal card do not appear at all.
Describing a vendor instead of describing your exposure
Vendor records drift into summarizing what the vendor says about itself. That text is worth filing, attributed to the vendor, but it is not the record.
Your record is about your side: which of your record categories the vendor can reach, which of your people own the relationship, what your agreement says, what you asked and when. A folder full of vendor marketing material with nothing about your own arrangements reads as thorough and answers nothing.
Writing conclusions you are not in a position to write
Short, attributed, dated statements of what a vendor told you will survive scrutiny. Confident assessments of whether a vendor is sound will not, because you did not verify them and a later reader has no way to tell what they were based on.
Record what was asked, what arrived, what did not, and who decided to proceed. Keep any opinion in a clearly separate section with a name and a date on it. Whether an arrangement is appropriate for your business is a judgment for the people accountable for it, with whatever professional input they need.
Leaving the gaps silent
A blank field is ambiguous: it could mean not asked, asked and refused, or asked and lost. Each of those tells a very different story, and the blank version tells none of them.
Write gaps as sentences. What you asked for, what came back instead, what you did about it, and who decided. A documented gap with an owner behaves completely differently from an empty cell.
Mistakes in how vendor risk documentation is stored
These are the dullest failures and they cause the most rework.
No date and no author
An undated record cannot be relied on, because nobody can tell whether it describes the current arrangement or one from three years ago. An unsigned record cannot be followed up, because there is nobody to ask.
Every document in a vendor folder needs a date it was written and a name that wrote it. Every table row needs a last-reviewed date. This single habit does more for the usefulness of a vendor file than any amount of additional content.
Records in one person’s mailbox
A review that lives in an email thread has produced a conversation, not a record. The same applies to files on a personal drive, notes in a personal notebook, and attachments in a chat history.
One folder per vendor, in a shared location, named the same way every time. When the folder is the unit, handovers are possible and the question “did we ever look at this company?” has an answer.
A list and a set of folders that disagree
Two sources of truth is the standard next failure after the first organized attempt. The list says eleven vendors; the folders say nine, two of them for companies no longer engaged.
Pick the list as the index and make it carry a column pointing at the folder. Then reconciling the two is a five-minute job at review time rather than an archaeology project.
Mistakes in keeping it current
Vendor records do not go wrong at the start. They go wrong slowly.
Reviewing at engagement and never again
A record made before a relationship started describes the smallest version of that relationship. Engagements grow: a new category of records is sent, a second team starts using the service, the vendor adds capabilities you now depend on.
The fix is a light scheduled pass plus event triggers. Re-open a vendor record when the scope of the work changes, when the vendor tells you about a change on their side, when your internal owner changes, and before you send anything new.
No owner, or an owner who does not know
A vendor record addressed to a department is addressed to nobody. An owner who was never told they own it is the same thing with extra steps.
Name one person, tell them in writing, and give them the ability to edit the record. When they leave, reassigning their vendors is part of the handover rather than a cleanup job for later.
Growth without retirement
Vendor lists only ever get longer unless someone retires entries. Ended engagements stay in the live section, duplicates accumulate as the same company is entered twice under two spellings, and the list stops being readable.
Move ended engagements to a closed section with the date and reason rather than removing them, and merge duplicates at review time.
Mistakes at the end of an engagement
The closeout is where documentation most often simply stops, because nothing forces it to happen.
The pattern is familiar. The work finishes, the invoices stop, and nobody writes down that the relationship ended, what the vendor still holds, or what was handed back. Months later the vendor is still on the live list, still named against rows of the data inventory, and still shown to anyone who asks who touches your records.
Three lines prevent most of it. A dated confirmation that the engagement ended and who confirmed it. A line per item of what was returned, withdrawn or closed. And a note of what the vendor says it retains, in whatever terms your agreement uses, filed rather than paraphrased. Then update the vendor list, the data inventory rows that named them, and any register entry that referenced the engagement.
A short self-check for your vendor risk documentation
Run this against three or four vendor folders rather than the whole set. If the same column fails repeatedly, that is the habit to fix first.
| Check | Passes if | Usual failure |
|---|---|---|
| Can you find it | One named folder, reachable by more than one person | Email thread or personal drive |
| Is it dated | Every document and row carries a date | Undated review from an unknown year |
| Is it attributed | A name on the document and on the decision | “We reviewed this” |
| Does it describe your side | Record categories, owner, agreement, what you asked | Vendor material only |
| Are the gaps written | Named plainly, with what you did about them | Blank fields |
| Is it current | A dated pass, plus appended changes | Accurate as of the day you signed |
| Does it close | A dated closeout with items listed | Record stops mid-engagement |
None of these fixes require tools or specialist help. They require that records are dated, attributed, findable and retired, which is a habit rather than a project.
Pick the two failures on that table you recognize, fix them across your existing folders, and apply the habit to the next vendor you take on rather than trying to rebuild everything at once. For a plain list of the records that make up a complete set, including the vendor folders, the data inventory and the register, see the Trust Center Document Checklist page on this site.