Vendor Offboarding: A Checklist for Reducing Risk and Simplifying the Process

Vendor Offboarding Challenges

Procurement, vendor management, and security teams often view third-party risk management (TPRM) as an exercise to be conducted prior to onboarding a new vendor. So, it’s no wonder that vendor offboarding is an afterthought at many organizations. The 2022 Third-Party Risk Management Study showed that only 43% of companies are tracking risks at the offboarding stage of their vendor relationship. While due diligence in vendor sourcing and selection is an important activity, measuring and managing risk extends throughout the relationship with a vendor. This includes managing the end of a relationship with thorough vendor offboarding.

Limited Stakeholder Involvement

As with vendor onboarding, knowledge silos can make it difficult to identify all the required tasks to offboard vendors. Procurement may notify a vendor that a contract will not be renewed, but legal must review contract terms and provide details on what steps are required for a clean termination. In some cases, engineering may need to identify intellectual property shared with the vendor. Manufacturing and operations must confirm what steps are required to avoid production stoppages. Finance must identify outstanding invoices or credits owed by the vendor. IT security must ensure that data is destroyed and system access is revoked. Without coordination between these teams, offboarding is a complicated task.

Lax Offboarding Due Diligence

It is easier to focus on activities with new vendors than on those being offboarded. To mitigate the risks referenced above, it is critical to be thorough when offboarding a vendor. This requires all team members that interact with the vendor to identify potential risks, agree to mitigation requirements, and meticulously track progress. Manual methods for performing due diligence will inevitably lead to missed tasks and unresolved risks.

Incomplete Visibility into Risk Mitigation

Tracking tasks in spreadsheets or shared documents can make the offboarding process inconsistent and prone to errors. The completeness and accuracy of a task list is subject to the expertise of everyone involved in the offboarding process. For example, a less-experienced employee may overlook critical tasks or incorrectly mark an item complete without full documentation from a vendor. Spreadsheets that can be accessed by multiple employees also lack auditing controls.

Vendor Offboarding Best Practices

A centralized process can help teams automate vendor offboarding, ensure its completeness, and effectively mitigate risk. Here are seven best practices to follow during offboarding:

1. Keep Lines of Communications Open

Teams can mitigate risk by keeping the lines of communication open with the vendor throughout the offboarding process. This includes informing vendors of the offboarding timeline, answering any questions, and providing clear instructions regarding what is expected during the process. A solution that centralizes interactions with vendors, maintains tasks and timelines, and requires approval workflows will greatly reduce the manual work required to address these issues.

2. Perform a Final Review of the Contract

Review the contract’s termination provisions to ensure you have the right to terminate the relationship, and if so, the proper timelines for doing so. If you are terminating due to a breach of contract terms, be sure notices have been issued and the vendor’s rights to remedy shortcomings have been honored. Teams may have changed contract terms over time. A final review with legal and procurement can identify scope creep and ensure that the vendor provided all the contractually obligated goods and services.

Finally, review KPIs, pending deliverables, and payments. If the vendor is supplying parts, make sure warranty and support agreements that survive termination are clear.

3. Settle Any Outstanding Invoices

After thoroughly reviewing the contract terms and identifying remaining obligations for both parties, ensure that you receive final deliverables and schedule final payments. Be sure to include any credits or returns when calculating payments, as these may be difficult to recover after you terminate the relationship.

4. Revoke Access to IT Infrastructure, Data and Physical Buildings

Partners and vendors may require access to your systems, such as those used for purchasing, engineering, marketing, and financial data. When offboarding a vendor, it is critical to terminate their access to your intellectual property and other sensitive data. This includes:

• Ensuring you have a list of all vendor accounts and deleting login credentials.
• Providing the vendor with a complete list of all company-owned equipment they must return. When repurposing returned equipment, be mindful of data retention requirements.
• Changing all logins, including shared credentials if a vendor has elevated privileges to systems.
• Deauthorizing access to all applications, including VPNs and cloud apps for file sharing and messaging.
• Deauthorizing any access the vendor may have had through APIs, as these could be a useful attack vector if a hacker later compromises the vendor.

Some vendor employees may have required physical access to your offices or server rooms. Deactivate any keycards and badges and ensure that the vendor returns all physical keys. In some cases, it may be necessary to change entry codes to server rooms. Work with your physical security teams to ensure that there is a clear process in place for managing physical vendor access.

5. Review Data Privacy and Information Security Compliance

Vendors often have access to sensitive data that may be subject to regulatory requirements such as CCPA, GDPR, PCI DSS, and others. During offboarding, ensure that you align your vendor termination procedures with your legal obligations. Third-party risk management platforms will have built-in reporting that aligns to these regulatory obligations, simplifying the compliance process.

If the vendor has copies of your sensitive data, it could be exposed in a later breach. Morgan Stanley failed to properly oversee decommissioning of servers by a third party. A subsequent breach of the third party exposed personal information and resulted in a $60 million fine from the Office of the Comptroller of the Currency (OCC). Ensure that all intellectual property and sensitive data is returned. Also, require an affidavit from the vendor that electronic copies on the vendor’s infrastructure – including on employee devices – are securely deleted. Additionally, review with the vendor remaining obligations such as confidentiality, nondisclosure and non-compete agreements.

6. Update Your Vendor Management Database

Not all terminations are permanent. You will want a clear record of the vendor’s history with your organization, including the vendor’s key performance indicators (KPIs). To reduce legal risk, clearly document the reasons for terminating the relationship and maintain a complete accounting of the termination procedures. Make sure you have records of all communications, contracts and other documentation between your organization and the vendor so you can quickly resolve any questions or issues moving forward.

7. Continuously Monitor Vendors for Potential Future Risks

Even though the contract has been terminated and all tasks have been successfully completed, risks to your systems and data, as well as compliance or reputational risks, can still emerge long after the relationship ends. Continuously monitoring multiple risk vectors will ensure that your team has extended visibility into potential future risks.

Next Steps for Improving Your Vendor Offboarding Process

Manually managing vendor offboarding across a large organization can drain even well-staffed risk management teams. While taking steps such as centralizing vendor data, and ensuring uniform offboarding processes across the organization can help, most large organizations benefit enormously from utilizing a dedicated third-party risk management platform.

A dedicated TPRM platform can:

• Provide a single source of the truth for vendor information, encouraging internal stakeholder and vendor collaboration in a central solution.
• Centralize contract lifecycle management, automating tasks to ensure that contractual provisions are met to protect the company.
• Automate the assessment and continuous monitoring of vendor risks – from onboarding to offboarding – centralizing results in a single risk register that enables coordinated action.
• Offer remediation guidance to ensure offboarded vendors meet your company’s compliance and security requirements to an acceptable level of risk.
• Deliver a prescriptive process to address final tasks and report according to compliance requirements.

Interested in how Prevalent can help reduce risk during offboarding as part of your broader third-party management lifecycle? Request a demo today.