Why Collecting Vendor Documentation Isn't Due Diligence

Most vendor management programs are designed around collecting documentation. Safety programs, certificates of insurance, training records, COR certificates, and policies are gathered. Yet collecting information and understanding it are two very different things.

The real question is not whether you've received vendor documentation. The real question is whether you know what it means before a vendor steps onto your site.

---

Summary

The purpose of vendor compliance is not to create a historical record of risk. The purpose is to identify and address risk while there is still an opportunity to act. This article explores the difference between collecting documentation and understanding the contents of that documentation along with a high level comparison of approaches to vendor management.