Vendor Intelligence
Resource Center

Part 1 — Vendor Strategy Foundation

Every vendor management program starts with a clear strategy. Define what you need from your vendor ecosystem before you start managing it.

• Define your vendor categories: Group vendors by service type, criticality, and spend level
• Set your concentration targets: No single vendor should exceed 20% of category spend without a documented justification
• Establish your preferred vendor list: Maintain a short list of pre-qualified vendors per category to reduce sourcing time
• Create vendor classification tiers: Strategic, Core, and Long-Tail — each with different management intensity

Part 2 — Vendor Discovery & Onboarding

The quality of your vendor relationships is determined before the first invoice is issued. Onboarding is your first opportunity to set expectations and collect what you need.

• Always collect COI before any work begins — no exceptions
• Use a standardized onboarding packet so every vendor provides the same documentation
• Verify licenses and registrations independently — do not rely on self-certification alone
• Set payment terms in writing during onboarding, not after first invoice

Part 3 — Performance Management

You cannot manage what you do not measure. A structured scorecard applied consistently is the single most valuable vendor management tool.

• Score vendors quarterly at minimum — monthly for Strategic tier
• Use the same scorecard criteria for every vendor in a category so comparisons are valid
• Share scorecard results with vendors — transparency drives improvement
• Set improvement plans for any vendor scoring below 70 — with a defined timeline and consequence

Part 4 — Risk & Compliance Monitoring

Vendor risk is dynamic. A vendor that was compliant at onboarding may not be compliant six months later. Build a system for ongoing monitoring — not just initial verification.

• Set COI expiration alerts — 30 days before expiration at minimum
• Review vendor financial health annually for any vendor above 10% of category spend
• Monitor for ownership changes, debarment, or sanctions — especially for government work
• Conduct an annual vendor portfolio review to identify consolidation opportunities

Part 5 — Vendor Offboarding

Offboarding a vendor poorly creates legal exposure and operational disruption. Have a process before you need it.

• Define offboarding triggers in every vendor contract — performance thresholds, insurance lapses, etc.
• Maintain at least one qualified alternative for every Strategic and Core vendor
• Collect all deliverables, data, and IP before terminating access
• Document the reason for offboarding — this is your institutional memory for the next procurement cycle

Step 1 — Calculate Your Concentration Ratio

Add up the total spend for your top 3 vendors. Divide by your total vendor spend. Multiply by 100 to get a percentage.

• Under 30% — Low Risk: Healthy diversification across your vendor base
• 30–50% — Moderate Risk: Monitor and maintain alternatives for top vendors
• 50–70% — High Risk: Formal mitigation plan required for top vendors
• Over 70% — Critical Risk: Immediate action — single event could disrupt operations

Step 2 — Map Operational Dependency

Spend concentration alone does not capture the full picture. A vendor representing only 5% of spend may provide a mission-critical service with no qualified alternative available in your market. For each top-10 vendor, assess:

• How many days could you operate without this vendor if they went dark?
• Do you have at least one qualified alternative pre-identified?
• Is this vendor's failure covered in your business continuity plan?

Step 3 — Check for Entity Duplication

A vendor operating under multiple entity names in your system can mask true concentration. Search your vendor master for similar names, shared addresses, or the same contact information. This is one of the most common and overlooked risks in large vendor ecosystems.

Step 4 — Build Your Mitigation Plan

• Identify at least 2 pre-qualified alternatives for any vendor above 15% of category spend
• Add concentration review as a standing quarterly agenda item
• Include concentration limits in new vendor contracts — no single vendor above X% without executive approval
• Use AI-powered spend analysis to automate concentration monitoring across your full vendor base

Legal & Entity (6 Items)

• ☐ Legal business name and DBA verified
• ☐ Business entity type confirmed (LLC, Corp, Sole Proprietor)
• ☐ EIN / Federal Tax ID collected
• ☐ W-9 (domestic) or W-8BEN (international) on file
• ☐ State of incorporation or registration verified
• ☐ Business license verified for applicable trade and state

Insurance & Bonding (7 Items)

• ☐ Certificate of Insurance (COI) on file — expiration date logged
• ☐ General Liability — minimum $1M per occurrence, $2M aggregate
• ☐ Workers' Compensation — statutory limits for applicable state
• ☐ Professional Liability (if design, engineering, or advisory services)
• ☐ Auto Liability (if vendor operates vehicles on your behalf)
• ☐ Umbrella / Excess policy (for engagements over $500K)
• ☐ Performance bond or surety bond (for construction or high-value delivery)

Agreements (4 Items)

• ☐ Master Service Agreement (MSA) fully executed
• ☐ Non-Disclosure Agreement (NDA) signed
• ☐ Subcontractor Agreement executed (if applicable)
• ☐ Data Processing Agreement signed (if vendor handles sensitive data)

Qualifications & Certifications (5 Items)

• ☐ Trade licenses verified independently (electrical, plumbing, HVAC, low voltage, etc.)
• ☐ Industry certifications documented (OSHA, manufacturer, safety)
• ☐ Diversity certifications captured (MBE, WBE, SDVOSB, HUBZone, 8a)
• ☐ SAM.gov registration active (for any government-funded work)
• ☐ Debarment / exclusion check completed (SAM.gov exclusions list)

Financial & Banking (3 Items)

• ☐ ACH / banking details collected for payment processing
• ☐ Payment terms agreed and documented in writing
• ☐ Credit or financial review completed (for engagements over $250K)

Scoring Categories & Weights

• Quality of Deliverables — 25%: Accuracy, completeness, and consistency of work product or service delivery. Does the vendor consistently meet the stated scope?
• Responsiveness & Communication — 20%: Speed and quality of response to requests, questions, escalations, and issues. Are they easy to reach and clear when they communicate?
• On-Time Performance — 20%: Adherence to agreed schedules, milestones, and delivery commitments. Do they hit deadlines without being chased?
• Compliance & Documentation — 15%: Current insurance, licensing, certifications, and contract adherence. Are their records always current and accessible?
• Cost & Value — 10%: Competitive pricing relative to market benchmarks, invoicing accuracy, and overall cost efficiency. Do you get what you pay for?
• Strategic Value & Partnership — 10%: Proactive problem-solving, innovation, relationship quality, and long-term partnership potential. Do they make you better?

Rating Scale

• 5 — Exceptional: Consistently exceeds expectations across all dimensions
• 4 — Strong: Meets expectations reliably with occasional excellence
• 3 — Adequate: Meets minimum requirements but rarely goes beyond
• 2 — Below Standard: Frequently fails to meet requirements — patterns of issues
• 1 — Unacceptable: Significant and repeated failures requiring immediate action

Action Thresholds

• 85–100 — Strategic Vendor: Prioritize, renew early, consider expanding scope
• 70–84 — Core Vendor: Maintain relationship, set improvement targets for any category below 3
• 55–69 — At Risk: Issue formal improvement plan with 90-day review checkpoint
• Below 55 — Phase Out: Begin transition planning and activate pre-qualified alternatives

Tier 1 — Strategic Vendors

Your highest-value, highest-dependency relationships. Typically 5–15% of your vendor count but 60–80% of your spend or operational reliance. These vendors require active, executive-level management.

• Assign a dedicated relationship manager
• Conduct quarterly executive business reviews (EBRs)
• Review scorecards monthly — share results with the vendor
• Develop joint business continuity and succession plans
• Negotiate multi-year contracts with clear SLAs, exit provisions, and renegotiation triggers
• Maintain a pre-qualified backup for every Strategic vendor

Tier 2 — Core Vendors

Reliable operational vendors supporting recurring services. Typically 15–30% of vendor count and 15–30% of spend. These vendors get structured management without executive-level intensity.

• Semi-annual performance reviews with documented outcomes
• Quarterly scorecard review — escalate below-threshold results
• Standard MSA and compliance documentation current at all times
• Defined escalation path and contact hierarchy
• Annual rate and scope review aligned with contract terms

Tier 3 — Long-Tail Vendors

Low-spend, low-frequency vendors. Often 50–70% of your vendor count but less than 10% of total spend. This tier is where most organizations waste the most management resources for the least return.

• Minimal management overhead — automate compliance reminders
• Annual compliance verification only (COI, license, W-9)
• Actively consolidate — identify which can be replaced by existing Tier 2 vendors
• Set a target: reduce this tier by 25–35% annually through consolidation
• Do not create custom agreements — use standard purchase orders

How to Classify Your Vendors Today

Pull your vendor spend report sorted highest to lowest. Draw a line where cumulative spend reaches 80% of total — everything above that line is Tier 1. The next 15% of cumulative spend is Tier 2. The remaining vendors are Tier 3.

Step 1 — Form Your Business Entity

You must have a legally registered business before you can receive federal contracts. An LLC is the most common structure. In Florida, register at sunbiz.org for $125. You will also need an EIN from irs.gov — free, issued instantly online.

Step 2 — Register on SAM.gov

SAM.gov (System for Award Management) is the official federal vendor registry. Registration is free and mandatory. You will need your EIN, business bank account routing and account numbers, and your physical business address. Activation takes 7–14 business days after submission.

Step 3 — Select Your NAICS Codes

NAICS codes define what services you sell to the government. You may register under multiple codes. Your primary code determines which set-aside programs you qualify for. Common codes for technology and professional services:

• 541511 — Custom Computer Programming Services
• 541512 — Computer Systems Design Services
• 541614 — Process and Logistics Consulting
• 541990 — All Other Professional Services
• 238210 — Electrical Contractors (for AV/low voltage)

Step 4 — Identify Your Set-Aside Programs

• Small Business Set-Aside: Open to all businesses under SBA size standards. Competes only against other small businesses.
• 8(a) Business Development Program: For socially and economically disadvantaged business owners. Allows sole-source contracts up to $4.5M — no competition required.
• HUBZone: For businesses and employees located in Historically Underutilized Business Zones. Check eligibility at maps.certify.sba.gov.
• SDVOSB: Service-Disabled Veteran-Owned Small Business. Self-certify on SAM.gov.
• WOSB: Women-Owned Small Business. Apply through SBA at certify.sba.gov.

Step 5 — Find and Respond to Opportunities

All federal contract opportunities are posted at SAM.gov. Search by NAICS code, keyword, or agency. Set up automated email alerts for your service categories. Respond to Sources Sought notices — these cost nothing to answer and put you directly on agency radar before a formal solicitation is issued.

Step 6 — Build Your Capability Statement

A capability statement is a one-page document that introduces your company to contracting officers. It must include your core competencies, differentiators, past performance examples, certifications, NAICS codes, CAGE code, and UEI number. This is your government resume — have it ready before any agency meeting.

Licensing & Legal

• ☐ Valid contractor's license for the applicable state and trade — verified independently through the state licensing board
• ☐ Business entity verified through Secretary of State lookup — confirm the business is active and in good standing
• ☐ No active debarment or suspension — check SAM.gov exclusions database
• ☐ OSHA 10 or OSHA 30 certification current for all field personnel (if project requires)
• ☐ Manufacturer certifications verified for any branded equipment installation

Insurance Requirements

• ☐ COI received naming your company as Additional Insured
• ☐ General Liability — $1M per occurrence, $2M aggregate minimum
• ☐ Workers' Compensation — statutory limits for the applicable state — no gaps in coverage
• ☐ Auto Liability — minimum $1M combined single limit if vehicles used on project
• ☐ Professional Liability — required for engineering, design, or advisory roles
• ☐ Umbrella policy — required for projects over $1M contract value

Financial & Payment

• ☐ W-9 collected and filed
• ☐ ACH / banking information on file for payment
• ☐ Payment terms agreed in writing before mobilization
• ☐ Lien waiver process confirmed and understood by both parties
• ☐ Bonding capacity verified for projects requiring performance bonds

Contract & Agreements

• ☐ Subcontractor Agreement fully executed — scope, schedule, compensation all defined
• ☐ Safety plan acknowledgment signed
• ☐ Insurance requirements accepted in writing
• ☐ Change order process agreed before project start

Past Performance

• ☐ Minimum 2 references checked — confirm project type, size, and performance rating
• ☐ Past project scope verified — ensure they have done work of comparable complexity
• ☐ Any prior disputes, claims, or liens investigated and resolved

RFI Structure — 7 Sections

Section 1 — Company Overview

• Legal business name and DBA if applicable
• Founding year and headquarters location
• Ownership structure and parent company if applicable
• Total employee count and field technician headcount
• Annual revenue range (provide bands: under $1M, $1–5M, $5–25M, $25M+)

Section 2 — Core Capabilities

• Primary services offered — be specific, not generic
• Industries served with representative client examples
• Geographic coverage — verified service areas vs. project-based travel
• Technology platforms, tools, and systems used in delivery

Section 3 — Certifications & Compliance

• Trade licenses held and states where active
• Insurance coverage types and limits currently in place
• Industry certifications (manufacturer, safety, professional)
• Diversity certifications held (MBE, WBE, SDVOSB, 8a, HUBZone)
• SAM.gov UEI number if registered

Section 4 — Past Performance

• 3 references from comparable engagements — include contact information, project type, scope, and value
• Largest single project completed — type, value, and duration
• Any government past performance — agency, contract number, period of performance

Section 5 — Financial Stability

• Years in current business structure
• Client retention rate (approximate)
• Bonding capacity if applicable to your engagement type

Section 6 — Technology & Reporting

• Project management systems used
• Reporting capabilities and formats available
• Integration capability with your existing platforms
• Data security certifications if handling sensitive information

Section 7 — Pricing Structure

• Preferred pricing model (hourly, fixed, T&M, retainer)
• Standard billing cycle and payment terms required
• Volume pricing availability for ongoing engagements

Best Practices for Sending RFIs

• Set a clear response deadline — 7–10 business days is standard
• Specify exact format so responses are directly comparable
• State clearly that an RFI is not a commitment to award or negotiate
• Score all responses against the same weighted rubric before moving to RFP stage
• Follow up with every respondent — those who do not receive feedback often disengage permanently

Spend Red Flags

• 1. Spend spike with no corresponding project or change order: A sudden increase in a vendor's invoices without an approved change order or new statement of work is one of the clearest signals of scope creep or billing irregularity.
• 2. Duplicate invoice patterns: The same invoice amount from the same vendor within 30 days — especially common in manual AP environments. This is the most frequently missed form of vendor overbilling.
• 3. Consistent round-number invoices with no itemization: Repeated $5,000 or $10,000 invoices with no line-item detail on a time-and-materials agreement may indicate time padding rather than documented work.
• 4. Spend clustering just below approval thresholds: Multiple invoices at $4,800–$4,999 when $5,000 triggers additional approvals is a classic internal control evasion pattern.

Vendor Relationship Red Flags

• 5. Single-source vendor with no documented alternative: Creates pricing dependency and removes your leverage at every renewal. Every sole-source relationship above 10% of category spend should have a documented backup plan.
• 6. Expired COI or license on an active vendor: You are legally exposed on every day of work performed without current documentation. This is discovered in audits and litigation — not proactively.
• 7. Vendor primary contact using a personal email address: May signal a shell entity, an individual moonlighting, or a vendor operating without proper business structure and tax compliance.
• 8. Same vendor appearing under multiple entity names: Often a sign of reorganization to escape poor past performance records or outstanding liens. Common in construction and technology sectors.

Performance Red Flags

• 9. Escalations increasing with no documented root cause correction: Patterns of repeat issues without resolution indicate the vendor is managing symptoms, not causes. This trajectory ends in a service failure.
• 10. Scorecard scores declining over three or more consecutive periods: A vendor in sustained decline rarely self-corrects without external pressure. Waiting for a failure event to act is the most expensive approach.
• 11. Frequent contract modification requests: Vendors requesting scope or pricing modifications repeatedly may have underpriced the original engagement, have capacity constraints, or are testing your willingness to accept scope creep.
• 12. Slow or inconsistent response to compliance document requests: A vendor who cannot produce a current COI or license on demand within 24–48 hours has a compliance management problem. The documentation exists — or it does not.