Skip to content
Vendors and third-party risk

Recording a contract

The arrangement, not the supplier, is what most obligations actually attach to — which is why this register carries more than a renewal date.

Updated

A vendor is a counterparty. A contract is the arrangement you have with it — and under most third-party regimes, including DORA, it is the arrangement that carries the obligations, the terms and the reporting. One vendor can hold several, and they can be classified differently.

From Vendors → Contracts, choose Add contract — or open a vendor and use its Contracts tab, which pre-fills the vendor for you.

  1. Vendor and timing. Which counterparty, and the dates: start, end, notice and renewal. These drive every “what expires when” view you will later rely on.

  2. Financial. Contract value and currency. Worth filling even when it feels like procurement’s business — concentration analysis is a money question as much as a count.

  3. Arrangement details. What kind of arrangement this is, and the contract type and status from your own configured lists (see Setting up your organization).

  4. Service characteristics. What the vendor actually does for you, and how replaceable they are: substitutability runs from easily substitutable to not substitutable. This is a judgement, and it is reported.

  5. Business functions. Which of your functions this arrangement supports. Linking them is what turns a contract register into a dependency map — and what makes a Register of Information possible to produce at all.

Save, and the contract opens with its own tabs.

  • Documents — the signed agreement, the DPA, the SLA, amendments. Upload them here; earlier versions are kept rather than replaced.
  • Clauses — the contractual-provision assessment (below).
  • SLA — service levels and the KPIs measured against them.
  • Approvals — the sign-offs recorded against this arrangement.

Under DORA, Article 30 lists provisions a contract for ICT services must contain. Vendorica assesses your contracts against that list and keeps the result as a register: per contract, which provisions are present, which are partial, and which are missing.

The DORA Article 30 clause gap register

The Article 30 gap register — the mandatory provisions as an org-wide checklist, each row showing per-contract coverage.

Read it as a renegotiation queue rather than a score. A missing provision on a low-criticality arrangement can wait; the same gap on a contract supporting a critical function is the conversation to have at the next renewal.

  • One arrangement, one contract row. A master agreement plus three order forms is usually one arrangement, not four — but if they carry different services or different terms, split them. The test is whether they would be reported separately.
  • Record the end date even when it renews automatically. “Evergreen” is a renewal cadence, not the absence of one, and a contract with no dates is invisible to every expiry view in the product.