The Year-End Vendor Review That Fits in One Afternoon
You do not need a procurement department to review your key vendors. One afternoon, five questions and a ranking will carry you into next year.

Formal vendor assessments are built for companies with procurement departments. Most businesses have neither the staff nor the appetite, so the review simply never happens, and the company learns about its vendors from the invoices.
There is a middle option. Before the year closes, take one afternoon and the short list of vendors that would actually hurt you. Five questions per vendor, one page of notes, and you enter January knowing things December-you was guessing.
Key takeaways
Review the vendors that would hurt, not every name in the ledger.
Five questions carry the afternoon: what they touch, who owns them, what happened, what changed, what you need next.
Every important vendor needs a named internal owner, not a shared inbox.
Write down what you learn while acting on it is still cheap.
The output is a short list of January conversations, not a binder.
Step 1: Pick the vendors that matter
Criticality is a short test. Would their outage stop your business this week? Do they hold your sensitive data or your customers'? Do they have broad access into your systems? A yes to any of those puts them on the list.
For most companies that produces ten to fifteen names. That is the right size for one afternoon.
Step 2: Ask the five questions
For each vendor on the list: What do they touch, in one line? Who inside the company owns the relationship? What happened this year, good and bad, including incidents, near-misses and slow support? What changed: ownership, pricing, the product direction, the people you deal with? And what do you need from them next year that you are not getting now?
This fictional example shows the record. It is an illustration, not a prescription.
| Vendor | Why they matter | Internal owner | This year | Next year's ask |
|---|---|---|---|---|
| Managed IT provider | Runs the network and holds admin access | COO | Two slow escalations | Quarterly review with metrics |
| Payroll platform | Employee and bank data | Finance lead | Smooth year | Confirm recovery testing |
| Industry SaaS tool | Daily operations depend on it | Operations lead | Price up 20% | Renewal options in writing |
The table is not the review. The conversation that fills it in is.
Step 3: Assign or confirm the internal owner
Every row needs a name. Not a department, a person who would notice if the vendor went quiet and who the vendor knows to call. Where the honest answer is "nobody really owns this one," you have found the afternoon's most common and most useful result.
Step 4: Turn findings into January conversations
The notes earn their keep as a conversation list. Renew or renegotiate here. Fix the access there. Start the exit planning on the one that has been declining all year. Three conversations scheduled in January beat a dozen worries carried through the holidays.
The MSP quarterly review questions give depth for the vendor who runs your IT, and the vendor ownership question covers what to settle before something breaks.
Frequently asked questions
How is this different from a formal vendor assessment?
Scope and depth. A formal assessment sends questionnaires and reviews certifications; this is an internal stock-take of your most important relationships. It finds the conversations you need to have. Some of those conversations may justify the formal work afterward.
What if a vendor fails the review?
Failure usually means uncertainty, not a verdict: no owner, no idea what happened this year, no confidence about next year. That uncertainty is the finding, and the January conversation is the fix. Only a pattern of bad answers argues for planning an exit.
Should vendors know they are being reviewed?
The good ones expect it and the January conversations make it visible anyway. Asking a vendor what changed this year is normal business hygiene, and their answer tells you something either way.
Is once a year enough?
For the full list, yes, paired with quarterly attention to the top few. The afternoon review is the floor, not the ceiling.
A Defensible Next Step
Block one afternoon before the holidays and run the five questions on your top ten vendors. The January conversation list writes itself. Book a Decision-Clarity Call if you want a second pair of eyes on the ranking.
Get Board-Ready on AI and Cyber Risk
A 30-minute call. No charge. You'll leave with a clear read on where your oversight stands and what to do about it.


