The vendor register
Every third party you depend on, in one place — with the criticality band, lifecycle state and assessment history that decide what you owe each of them.
The vendor register is the spine of the product. Almost everything else — contracts, assessments, risks, the DORA register — either hangs off a vendor or explains one.
The register, with criticality tier, lifecycle state, country and owner on every row — and the peek panel a row opens into.
The three things a vendor carries
Section titled “The three things a vendor carries”A lifecycle state, which says where the relationship stands:
- Procurement — prospective, under review, not yet engaged.
- Active — onboarded and in use.
- Archived — no longer engaged. Archived rather than deleted, because the arrangement was real and your audit trail should still say so.
A criticality tier, which is your own risk banding — see Criticality and classification. It is orthogonal to the lifecycle state: a supplier can be in procurement and already obviously critical.
An owner, the person accountable for the relationship. Ownership is what turns a register into a working system rather than a list; an unowned vendor is one nobody will reassess.
Direct suppliers and fourth parties
Section titled “Direct suppliers and fourth parties”The register holds two kinds of row, and by default shows one.
A directly engaged vendor is one you chose: procured, contracted, onboarded.
A fourth party is a supplier of one of your suppliers — it exists in your register because it turned up in a subprocessor chain, not because you have a relationship with it. These are hidden from the default list and reachable behind a filter, which keeps the register a list of your decisions while still letting you see the dependency chain beneath them.
A fourth party that you later engage directly simply becomes a direct supplier; the row does not fork. That matters for DORA concentration analysis, where the same provider appearing at two levels of your chain is precisely the thing you are looking for.