Best practices in vendor management are worth ranking by what they prevent rather than by how complete they make a policy document look. Ranked that way the order changes: the list comes first because nothing works without it, the renewal calendar second because it prevents the most expensive surprise, and scoring last because it only pays off once there is a year of it.
One list, built from the ledger
Every other practice depends on this one. Export twelve months of payees, dedupe, and add owner, category and status. A business that cannot say who its suppliers are cannot do diligence, consolidation, renewal management or performance review, because all four operate on a list that does not exist yet. This is the practice that unlocks the rest, and it is an afternoon.
Diligence sized to the vendor, not applied to everybody
Running the same heavy checks on every supplier is abandoned within a quarter; running the same light checks on all of them means the vendor holding your customer data got the same scrutiny as the one selling envelopes. Size it: a baseline for everyone, then more for data access, site access, single-sourcing and spend. The worked example needs ten checks where the baseline is three.
Alerts on notice dates, owned by a person
The renewal calendar is where money is actually saved and lost. Alert before the notice window opens, not on the renewal date, and send it to the person who owns the relationship rather than to a shared mailbox. Most vendor management software is bought after the first renewal somebody found out about from a bank statement.
Score consistently, and keep the scores
Same criteria, same weights, same scorer, every year. A precise score is worth less than a comparable one, because the value is in the trend. On the worked example five weighted criteria give 74 out of 100 against a threshold of 70, and next year's 68 means something only because it was measured the same way.
Offboard properly, because the risk outlives the invoice
Access revoked, data returned or destroyed, contract closed within its notice terms, final invoice reconciled, record marked offboarded rather than deleted. A former supplier that still holds a login or a copy of your customer data is still an exposure, whatever the payment history says.
Questions people ask about best practices in vendor management
What is the single highest-value practice?
A renewal calendar with notice dates and named owners. It is the cheapest to build and it prevents the most common and most expensive failure, which is renewing a contract you meant to leave.
How much diligence is proportionate for a small business?
A baseline of three checks for everybody, plus more for vendors that touch data, hold site access, are single-sourced, or take a large share of spend. The free worksheet on this site sizes it and says how many are outstanding.
Do we need a written vendor management policy?
A page is enough for most small businesses: what checks a vendor needs before approval, who approves, who owns the relationship, and when reviews happen. Longer policies are written to be filed, not followed.