Vendor Offboarding: A Checklist for Reducing Risk and Simplifying the Process

Vendor Offboarding Challenges

Procurement, vendor management, and security teams often view third-party risk management (TPRM) as an exercise to be conducted before onboarding a new vendor. So, it’s no wonder vendor offboarding is an afterthought at many organizations. While nearly 90% of companies track risks from the sourcing and selection phases, fewer than 80% track service-level agreements (SLAs) and offboarding risks later in the relationship lifecycle. While due diligence in vendor sourcing and selection is an important activity, measuring and managing risk extends throughout the relationship with a vendor. This includes managing the end of a relationship with thorough vendor offboarding.

Limited Stakeholder Involvement

As with vendor onboarding, knowledge silos can make it difficult to identify all the required tasks to offboard vendors. Procurement may notify a vendor that a contract will not be renewed, but legal must review contract terms and provide details on what steps are required for a clean termination. In some cases, engineering may need to identify intellectual property shared with the vendor. Manufacturing and operations must confirm what steps are required to avoid production stoppages. Finance must identify outstanding invoices or credits owed by the vendor. IT security must ensure that data is destroyed and system access is revoked. Without coordination between these teams, offboarding is a complicated task.

Lax Offboarding Due Diligence

It is easier to focus on activities with new vendors than on those being offboarded. To mitigate the risks referenced above, it is critical to be thorough when offboarding a vendor. This requires all team members interacting with the vendor to identify potential risks, agree to mitigation requirements, and meticulously track progress. Manual methods for performing due diligence will inevitably lead to missed tasks and unresolved risks.

Incomplete Visibility into Risk Mitigation

Tracking tasks in spreadsheets or shared documents can make the offboarding process inconsistent and prone to errors. A task list's completeness and accuracy are subject to everyone's expertise in the offboarding process. For example, a less-experienced employee may overlook critical tasks or incorrectly mark an item complete without full documentation from a vendor. Spreadsheets that multiple employees can access also lack auditing controls.

Vendor Offboarding Best Practices

A centralized process can help teams automate vendor offboarding, ensure completeness, and mitigate risk effectively. Here are seven best practices to follow during offboarding:

1. Keep Lines of Communications Open

Teams can mitigate risk by keeping the lines of communication open with the vendor throughout the offboarding process. This includes informing vendors of the offboarding timeline, answering questions, and providing clear instructions regarding what is expected during the process. A solution that centralizes interactions with vendors maintains tasks and timelines and requires approval workflows will greatly reduce the manual work required to address these issues.

2. Perform a Final Review of the Contract

Review the contract’s termination provisions to ensure you have the right to terminate the relationship and, if so, the proper timelines for doing so. If you terminate due to a breach of contract terms, be sure notices have been issued and the vendor’s rights to remedy shortcomings have been honored. Teams may have changed contract terms over time. A final review with legal and procurement can identify scope creep and ensure that the vendor provided all the contractually obligated goods and services.

Finally, review KPIs, pending deliverables, and payments. If the vendor supplies parts, ensure warranty and support agreements that survive termination are clear.

3. Settle Any Outstanding Invoices

After thoroughly reviewing the contract terms and identifying remaining obligations for both parties, ensure that you receive final deliverables and schedule final payments. Be sure to include any credits or returns when calculating payments, as these may be difficult to recover after terminating the relationship.

4. Revoke Access to IT Infrastructure, Data and Physical Buildings

Partners and vendors may require access to your systems, such as those used for purchasing, engineering, marketing, and financial data. When offboarding a vendor, it is critical to terminate their access to your intellectual property and other sensitive data. This includes:

• Ensuring you have a list of all vendor accounts and deleting login credentials.
• Providing the vendor with a complete list of all company-owned equipment they must return. When repurposing returned equipment, be mindful of data retention requirements.
• Changing all logins, including shared credentials if a vendor has elevated system privileges.
• Deauthorizing access to all applications, including VPNs and cloud apps, for file sharing and messaging.
• Deauthorizing any access the vendor may have had through APIs, as these could be a useful attack vector if a hacker later compromises the vendor.

Some vendor employees may have required physical access to your offices or server rooms. Deactivate any keycards and badges and ensure the vendor returns all physical keys. Sometimes, it may be necessary to change entry codes to server rooms. Work with your physical security teams to ensure that there is a clear process in place for managing physical vendor access.

5. Review Data Privacy and Information Security Compliance

Vendors often have access to sensitive data that may be subject to regulatory requirements such as CCPA, GDPR, PCI DSS, and others. During offboarding, align your vendor termination procedures with your legal obligations. Third-party risk management platforms will have built-in reporting that aligns with these regulatory obligations, simplifying the compliance process.

If the vendor has copies of your sensitive data, it could be exposed in a later breach. Morgan Stanley failed to oversee the decommissioning of servers by a third party properly. A subsequent breach of the third party exposed personal information and resulted in a $60 million fine from the Office of the Comptroller of the Currency (OCC). Ensure that all intellectual property and sensitive data are returned. Also, an affidavit from the vendor is required stating that electronic copies on the vendor’s infrastructure – including on employee devices – are securely deleted. Review with the vendor remaining obligations such as confidentiality, nondisclosure, and non-compete agreements.

6. Update Your Vendor Management Database

Not all terminations are permanent. You will want a clear record of the vendor’s history with your organization, including the vendor’s key performance indicators (KPIs). To reduce legal risk, clearly document the reasons for terminating the relationship and maintain a complete accounting of the termination procedures. Make sure you have records of all communications, contracts, and other documentation between your organization and the vendor so you can quickly resolve any questions or issues moving forward.

7. Continuously Monitor Vendors for Potential Future Risks

Even though the contract has been terminated and all tasks have been successfully completed, risks to your systems and data and compliance or reputational risks can still emerge long after the relationship ends. Continuously monitoring multiple risk vectors will ensure that your team has extended visibility into potential future risks.

Next Steps for Improving Your Vendor Offboarding Process

Manually managing vendor offboarding across a large organization can drain even well-staffed risk management teams. While taking steps such as centralizing vendor data and ensuring uniform offboarding processes across the organization can help, most large organizations benefit enormously from utilizing a dedicated third-party risk management platform.

A dedicated TPRM platform can:

• Provide a single source of the truth for vendor information, encouraging internal stakeholder and vendor collaboration in a central solution.
• Centralize contract lifecycle management, automating tasks to ensure contractual provisions are met to protect the company.
• Automate the assessment and continuous monitoring of vendor risks—from onboarding to offboarding—by centralizing results in a single risk register that enables coordinated action.
• Offer remediation guidance to ensure offboarded vendors meet your company’s compliance and security requirements to an acceptable level of risk.
• Deliver a prescriptive process to address final tasks and report according to compliance requirements.

Interested in how Prevalent can help reduce risk during offboarding as part of your broader third-party management lifecycle? Request a demo today.