Vendor Performance Audit

Framework: Vendor Performance Scorecard (VPS) Output: Scored vendor review, improvement plan or offboarding recommendation

Most vendor relationships drift because nobody's measuring them. This quarterly audit system gives you a structured way to evaluate every significant vendor, surface problems before they escalate, and make data-driven decisions about renewing, renegotiating, or replacing.

---

When to Run This Audit

• - Quarterly for all Priority vendors (ACV > $10K or operationally critical)
• Semi-annually for Standard vendors
• Triggered any time a major incident occurs (SLA breach, security issue, delivery failure)
• Pre-renewal (minimum 60 days before contract end)

---

Phase 1: KPI Scorecard

Rate each dimension 1-5. Be honest — this is for your decision-making, not the vendor's feelings.

Dimension 1: Delivery & SLA Performance (Weight: 30%)

Score	Criteria
5	Consistently exceeds SLA. Proactive communication on any hiccup. Zero surprise failures.
4

Meets SLA >95% of the time. Issues are rare and resolved quickly. | | 3 | Meets SLA most of the time. Occasional misses with reasonable resolution. | | 2 | Frequent SLA misses. Resolution is slow or requires escalation. | | 1 | Regular delivery failures. SLA is aspirational, not operational. |

Evidence required: Pull ticket data, delivery logs, or incident records. Don't score from memory.

Dimension 2: Quality of Output (Weight: 25%)

Score	Criteria
5	Output exceeds expectations. Error rate near zero. Rework is essentially unheard of.
4

Output meets quality bar consistently. Minor issues handled proactively. | | 3 | Generally acceptable quality. Some rework required. | | 2 | Quality is inconsistent. Rework is common. Internal team spends time fixing vendor output. | | 1 | Output frequently doesn't meet standards. Significant internal overhead to compensate. |

Dimension 3: Responsiveness & Communication (Weight: 20%)

Score	Criteria
5	Always reachable. Proactively surfaces issues. Communication is clear and timely.
4

Responsive within agreed SLA. Communicates proactively most of the time. | | 3 | Generally responsive but reactive. Sometimes requires chasing. | | 2 | Slow to respond. You often initiate all communication. Escalations required. | | 1 | Unreliable contact. Incidents discovered by you, not surfaced by them. |

Dimension 4: Value vs. Cost (Weight: 15%)

Score	Criteria
5	Clear ROI. Cost is at or below market for quality delivered. Strong value demonstrated.
4

Good value. Cost is reasonable given output and relationship quality. | | 3 | Market rate. Neither a bargain nor obviously overpriced. | | 2 | Starting to feel overpriced relative to value delivered or market alternatives. | | 1 | Overpriced for what we get. Alternatives would deliver more for less. |

Dimension 5: Strategic Alignment & Roadmap (Weight: 10%)

Score	Criteria
5	Deeply aligned. They understand our business and proactively help us get where we're going.
4

Good alignment. They know our goals and adjust accordingly. | | 3 | Transactional but functional. Delivers what's scoped, no more. | | 2 | Misaligned in places. Their direction and ours are diverging. | | 1 | No alignment. Product/service is moving away from our needs. |

---

Phase 2: Composite Score & Tier Classification

Weighted score calculation:

CODEBLOCK0

Max score = 5.0

VPS Range	Tier	Recommended Action
4.0 – 5.0	🟢 Green — Trusted Partner	Renew, consider expanding scope or strategic partnership
3.0 – 3.9

🟡 Yellow — Watch | Renew with conditions; issue improvement plan for lowest-scoring dimension |
| 2.0 – 2.9 | 🟠 Orange — At Risk | Renegotiate terms or begin sourcing alternatives; 60-day improvement window |
| 1.0 – 1.9 | 🔴 Red — Replace | Begin active replacement process; do not renew |

---

Phase 3: Issue Log Review

Before finalizing the score, review your incident/ticket log for this vendor over the review period:

• - How many incidents were opened? How many are still open?
• What was the average resolution time? Compare to SLA.
• Were any incidents flagged as critical/high-impact?
• Did any incidents result in downstream business impact (revenue loss, client complaints, compliance exposure)?

Incident severity modifier:

• - 1+ critical incident with unresolved root cause → drop tier by one level
• 3+ medium incidents unresolved → flag for improvement plan regardless of VPS score

---

Phase 4: Improvement Plan Template (Yellow & Orange Tiers)

If VPS < 4.0, issue a formal improvement plan:

Improvement Plan — [Vendor Name] — [Quarter]

• - Review Period: [start] – [end]
• VPS Score: [X.X] / 5.0
• Tier: Yellow / Orange
• Review Date: [90 days from today]

Key Issues Identified:

1. 1. [Specific issue with evidence]
2. [Specific issue with evidence]

Required Improvements:

1. 1. [Specific, measurable change required] — Target: [metric] by [date]
2. [Specific, measurable change required] — Target: [metric] by [date]

Consequences if not met:

• - Yellow: Move to Orange tier; begin parallel sourcing
• Orange: Contract not renewed; active replacement begins

Acknowledgment: Share this plan with the vendor. Get written acknowledgment.

---

Phase 5: Offboarding Trigger Criteria

Initiate replacement when ANY of the following are true:

• - VPS score < 2.0
• Two consecutive quarters in Orange tier
• Critical incident with material business impact and no credible root cause fix
• Vendor signals they are discontinuing the product/service
• Market alternative offers >30% better value at equivalent quality
• Compliance or security failure

When trigger is met: immediately move to replacement sourcing and set a hard cutover date.

---

Audit Schedule Template

Vendor	Category	ACV	Tier	Last Audit	Next Audit	Owner
[Name]	Software	$X	Green	[date]	[date]	[name]

Run this as a quarterly review in your ops calendar.