Your first 30 minutes

Vendorica can be filled in almost any order, but one order saves the most rework: decide how you classify suppliers before you load them, and pick the framework you are working to before you classify anything. Both decisions change what the rest of the product asks you for.

1. Check your criticality tiers.

   Every vendor is classified into one of your organization’s criticality tiers. New organizations start with four — critical, high, medium and low — but the tiers belong to you: rename them, reorder them, add or retire them to match the language your risk policy already uses.

   Each tier also carries a reassessment cadence — how often a vendor in that band should be reassessed. Setting it now means the product can tell you what is overdue later.

   See Criticality and classification.

2. Add two or three real vendors by hand.

   Not the whole estate — two or three you know well. Adding them manually once teaches you which fields your organization actually cares about, which is what makes the bulk import worth running.

   See Adding a vendor.

3. Turn on the framework you are working to.

   A framework tells Vendorica which obligations to hold you to and which registers to keep. If you are an EU financial entity, that is almost certainly DORA.

4. Invite the people who own the work.

   Vendor risk is not a one-desk job: the people who know a supplier are rarely the people who own the compliance obligation. Get the owners in early, with a role that matches what they actually do.

   See Inviting your team.

5. Then import the rest.

   With tiers, fields and owners settled, a bulk import lands in a shape you will not have to redo.

Do not start with the import

It is the obvious first move and it is the one that costs the most time. An import run before you have decided your tiers produces hundreds of rows classified into bands you are about to rename.

What you can safely leave for later

• Integrations. They enrich what is already there; they do not decide your structure.
• Assessments and questionnaires. Worth doing once a handful of vendors are classified, so you are assessing the ones that matter.
• Reports and exports. They read whatever you have. Nothing about them constrains earlier decisions.