Question

A department manager calls you and asks for your help designing a formal policy: “It’s for hiring vendors. We don’t have a formalized process for selecting and onboarding a new vendor. I want to make sure we know which stakeholders should be involved, what their roles are, and what steps need to happen in what order. As an example, we need to hire a new vendor to generate invoices for our clients. The stakeholders here are the specific internal group that will deal with the new vendor (the finance team), the internal legal group, and management. Since we’re a privacy law consulting firm it’s especially important that we conduct due diligence on the service provider to make sure they have good privacy practices. Internal Legal can handle that. Finance will need to evaluate the vendors. Maybe they can generate a shortlist first. We’ll also need to negotiate two contracts with whichever vendor we pick: first, a services agreement that lays out the terms of the engagement - the fee, what happens if one of us screws up, etc. Second, we really need to sign a Data Protection Addendum with the vendor. That will ensure they’re obligated to follow good privacy practices and, of course, that contract addendum is required by several privacy laws. Internal legal can also handle those contract negotiations and reviews, but we’ll need to make sure management has final say on the wording of those contracts before they are signed. Finance will probably be doing most of the communicating with the vendor about what the vendor is actually capable of doing and when they can start, but internal legal can handle all the contract negotiations, subject of course to management approval.”

Please write a step by step outline of a policy that describes the process for hiring a new vendor.

Answer 1

Policy Document - Vendor Selection Process

Participants - Finance, Internal Legal, Management, Originating Department

Step 1 : Originating department to identify requirement, proposed vendor details, and timelines to close go-no go decision in a 1 page memo to Management

Step 2 : Management approves opening of qualification process

Step 3 : Preliminary Due Diligence process to be initiated with Internal Legal on Privacy practices

Step 4 : Due Diligence completion and Approval by Internal Legal of Proposed Vendors to originating Department

Step 5 : Submission of final shortist to Finance for selection

Step 6: Finance evaluation and selection of vendors basis requirements and aligned parameters of selection. Originating Department informed of selection

Step 7 : Internal Legal to provide commercial contract and data protection addendum draft to share with vendor

Step 8 : Contract terms negotiation and closure between Originating Department, Vendor and Internal Legal

Step 9: Confirmation of appointment - formal communication to vendor by Finance

Step 10 : Begin Commercial operations.