Are Your Vendors Still Delivering?

A bank may be satisfied with a vendor relationship when the contract is signed. Over time, though, costs can drift, technology can change, and the people responsible for overseeing the service can move on. 

Those are among the challenges Steven Ramirez, CEO of Beyond the Arc, explored in ProSight’s recent “Vendor Management Beyond Due Diligence” webinar. He urged institutions to keep examining vendor performance, cost, risk, and overall value long after the initial vetting is complete. 

Ramirez highlighted several ways banks can stay on top of those changes: 

Keep ownership clear. A major technology provider may serve several business lines, with different employees using different products. Ramirez urged collaboration among business, technology, customer experience, and risk teams. Shared records and clear responsibilities matter when staff leave or departments reorganize. Important contracts and documentation should remain accessible to everyone who needs them. 

Watch how the service changes. A fintech might introduce useful integrations or new AI features. It might also shift investment away from a product the bank depends on. Either development can change the value and risk of the relationship. Banks need to examine new capabilities and decide whether they still fit operational needs, customer expectations, and risk tolerance. 

Measure more than contract compliance. Service-level agreements provide a baseline, but meeting contractual requirements does not necessarily mean a vendor is supporting the customer and employee experiences the bank wants to deliver. Ramirez offered a useful test: “Is this vendor really helping us to raise our game?” 

Recheck costs against actual use. Pricing often reflects assumptions made at the start of a contract. Ramirez used the example of software budgeted for 25 users that is consistently used by only 20.  He also discussed AI features with variable processing charges and cloud services that keep generating bills after their usefulness has ended. As he put it, “If you do any work on a cloud platform, costs usually only go in one direction:, up.” 

Understand the dependencies. A bank may rely on software and subcontractors several steps removed from its direct vendor. Ramirez also urged institutions to consider the importance, complexity, and potential impact of different services. Consolidating vendors can reduce duplication, but it may also make the remaining provider more critical to the bank. 

The takeaway: Vendor contracts may remain in place while the bank’s needs, costs, and exposures change. Keeping business, technology, and risk teams engaged helps institutions understand whether a vendor still delivers the value and protections they expected. 

For more on managing complex vendor relationships, join ProSight’s December 10 Risk Readiness webinar, “Rethinking Third-Party Risk in the AI Era,” exploring third- and fourth-party dependencies, concentration risk, ongoing oversight, and disruption preparedness.