Procurement Intake And Risk Tiering

Vendor intake and risk tiering

Purpose

Requests arrive as a product name and a deadline. What is missing is the need behind the name, and the two facts that determine how much diligence is required: what data the vendor will hold and what breaks if the vendor stops. Without a tiering step at the front door, every request gets either the full review — so the queue jams and people buy on a card instead — or none, so a supplier holding regulated data is onboarded on a click-through agreement. This skill is the intake and the tiering rule, applied before evaluation starts.

Prerequisites

• Inputs: the requester and their business unit, the problem being solved, the data the third party would process, the users and geographies affected, the indicative spend and term, and the required date.
• Access: the existing supplier register and application inventory, to check whether the capability is already licensed. This check kills a meaningful share of requests and must come before any external contact.

If the request names a product but cannot state the problem, stop and get the problem. A product-shaped request produces a single-option evaluation, which is not an evaluation.

Step 1 — Intake capture

Record all of these. A field left blank blocks tiering; it does not default.

Already-running trials: if the product is already in use, record it as an in-flight exception, tier it immediately, and route it at its tier. Do not let prior use lower the tier — an unreviewed supplier already holding data is a higher priority, not a lower one.

Step 2 — Score the two axes

Data exposure — the highest applicable band, based on what the vendor can access, not what the requester intends to send:

Business criticality — the impact of the vendor failing or being unavailable:

Step 3 — Assign the tier

Read the tier off the intersection. Do not reason about it in prose.

Escalators — apply after the table. Each raises the tier by one, to a floor of Tier 1:

• The vendor subcontracts processing to a fourth party holding the same data.
• Data leaves the jurisdictions where processing is permitted, or residency is undetermined.
• The integration requires privileged, administrative or write access to a system of record.
• The vendor's product makes or materially informs automated decisions about people.
• The supplier would become a single point of failure with no substitutable alternative.
• Regulated activity, or an activity subject to a supervisory outsourcing notification requirement, is being outsourced.

Escalators never lower a tier. If two people reach different tiers, the higher stands until the business owner and the risk function agree otherwise in writing.

Step 4 — Required reviews by tier

Nothing is exempt from the register. An unregistered supplier cannot be reassessed, cannot be included in an exit plan, and will not be found during an incident.

Procedure

1. Capture the intake fields. Missing fields block; they do not default.
2. Check the supplier register and application inventory for existing capability. Close the request if the need is already licensed.
3. Score the data-exposure band on what the vendor can access.
4. Score the business-criticality band on the outage impact.
5. Read the tier from the table, then apply escalators.
6. Record the tier with the reasoning: the two bands, each escalator applied, and the person who scored it. The record is what makes the tier auditable and defensible later.
7. Route to the reviews required for the tier, in parallel where they do not depend on each other.
8. Confirm the named business owner accepts accountability for the residual risk. No owner, no onboarding.
9. Hand to operations-vendor-evaluation for the comparison, with the tier attached so the evaluation weights risk criteria correctly.
10. Register the supplier with its tier, owner, renewal date and reassessment date.

Content rules

• Never assert a vendor's certification, control, or compliance status without evidence supplied by the vendor or a document you have seen. An assumed certification is the failure mode this whole process exists to prevent.
• Never lower a tier because of deadline pressure. Record the pressure and let the named owner accept the risk explicitly, in writing, with a date.

Data handling

Classification: Internal, moving to Confidential where the intake record contains commercial terms, security control detail, or a description of regulated data flows. Do not paste real personal data, customer records or account numbers into an intake form to illustrate what would be processed — describe the data categories instead. If such data is supplied, flag it and stop.

Boundaries

• Comparing shortlisted suppliers against weighted requirements — use operations-vendor-evaluation, which starts where this skill ends.
• Reviewing contract clauses, liability, data-processing terms or termination rights — use legal-compliance-contract-review.
• Granting user access to a system already procured — use it-access-review.
• Deploying or integrating the tool once approved — use it-change-management.
• Whether the spend is allowable and which budget it falls to — use finance-expense-policy-triage.
• Assessing a new regulatory obligation affecting the supplier base — use legal-compliance-regulatory-change-impact.

Hand-offs

• Receives from: it-service-desk-triage (requests arriving as a tool ask), finance-expense-policy-triage (spend caught without a supplier record), and business teams directly.
• Routes to: operations-vendor-evaluation (with the tier attached), legal-compliance-contract-review (Tier 1–3), it-access-review and it-change-management (post-approval), and executive-board-pack-preparation where a Tier 1 supplier needs governance approval.