Vendor onboarding + COI tracking automation.

Low-risk vendors (under $50K annual spend, no customer-data access, common service categories). Vendor self-serves through a portal — completes W-9, banking details for ACH, basic insurance certificate (COI) upload, sanctions check (auto via OFAC API), beneficial ownership disclosure where required. AI validates each submitted document, flags missing items with a polite reminder. Procurement reviews only when AI flags issues, not every submission.

Certificate of Insurance auto-parsed: insurer, policy number, coverage limits per type (general liability, auto, workers comp, professional indemnity), additional insured listed, effective dates, expiration. Validated against your contractual minimums for that vendor type. Expiration tracked in calendar — vendor + sponsor employee notified 60 / 30 / 7 days before expiry. Lapsed COIs auto-suspend the vendor in payment systems until renewal — a lapsed COI is a liability exposure waiting for the wrong incident.

Vendors touching internal systems or non-public data ($50K–$500K spend, internal data access). Requires standard onboarding plus security questionnaire (SIG Lite, your custom questionnaire, or industry-specific) and DPA (Data Processing Addendum) review. AI parses questionnaire responses + flags any non-standard answers (no SOC 2, no breach notification clause, data residency concerns). Security team reviews flagged items, not every response. DPA goes through contract intake automation.

SOC 2 Type II report uploaded; AI verifies issuer (legitimate audit firm), date (within 12 months), scope (covers the services your vendor will provide). Insurance certificates with higher coverage minimums (cyber liability if data access). Light financial review — D&B report or similar — to confirm vendor is a going concern, not a shell company you'd be sending checks to before bankruptcy. Annual re-attestation required; vendor stays in active state only with current evidence.

Critical vendors — customer-data processors, single-source operational dependencies, $500K+ spend, regulated services (HIPAA, financial services, government contractors). Full diligence: penetration test summary, business continuity plan + tested DR procedures, on-site or virtual security review, named security contact for incident response, sub-processor list with downstream attestations. AI orchestrates the diligence checklist; security/risk team owns judgment on findings. Process takes 4–8 weeks for new vendors — no shortcut.

Critical vendors don't get reviewed annually then forgotten. Continuous monitoring: news alerts on the vendor (security incidents, financial distress, ownership changes), security score services (SecurityScorecard, BitSight), public breach notification monitoring. Material changes trigger immediate review by your security team. Quarterly business review with vendor leadership for the most critical relationships. The vendor relationship is treated as live infrastructure, not paperwork-once.

Vendor active. Sponsor notified with onboarding-complete summary: vendor record link, COI expiry date, next attestation date, escalation contacts. Vendor sees their portal status. Procurement can issue POs; finance can pay invoices. Ongoing monitoring runs per risk tier — standard gets COI expiry watch; elevated adds annual re-attestation; critical adds continuous monitoring. The relationship is now in operational state, not in onboarding state.

Onboarding incomplete or evidence inadequate. Specific reason captured: COI coverage too low, SOC 2 expired, sanctioned ownership detected, security questionnaire revealed unacceptable practice. Remediation path documented — what would unblock activation? Vendor + sponsor notified with the specific gap and what would fix it. Some blocks are remediable (vendor obtains higher coverage); some aren't (vendor has sanctioned ownership and isn't usable).

Sponsor decides: pursue an alternative vendor (most cases), wait for the vendor to remediate (some cases), or escalate for executive risk acceptance (rare cases — usually when no alternative exists for a critical capability). Risk-acceptance escalations require legal + security + finance + executive sign-off with documented rationale and ongoing monitoring commitment. The audit trail captures every risk acceptance with the original justification, in case anyone needs to revisit it later.