Risk, compliance and operational policies · 06
Third-party, outsourcing and vendor management policy
Governs the risk the organisation takes on when it lets someone else do the work.
Governs the risk the organisation takes on when it lets someone else do the work.
Cover the pre-contract due diligence and its risk tiers; mandatory contract terms including audit rights, security, POPIA operator terms, sub-contracting consent and exit assistance; performance monitoring against service levels; the vendor register; concentration risk; and the offboarding procedure including return or deletion of data.
Responsibility cannot be outsourced, only the activity. Where the vendor processes personal information the organisation remains the responsible party under POPIA, and where the vendor performs a regulated function the regulator still holds the organisation. Draft the exit provisions at the start; they are impossible to negotiate at the end.
Related pages, tools and documents
Where this instrument sits in the wider set, and the engagement that produces it.
Start here
Tell us the decision your organisation needs to make.
The first conversation is thirty minutes, confidential and free. You will leave it knowing which of our services you need and which you do not.