VM-06 Third-Party / Vendor Management

Service Level & Performance Monitoring

Vendor delivery is monitored against commitments.

Domain
Third-Party / Vendor Management
Control type
Detective
Automated / manual
Manual
Frequency
Periodic
Framework reference
MAS Outsourcing

What good looks like

Vendor SLAs defined and monitored; breaches escalated.

Risk if it fails

Service degradation unmanaged.

How Tess tests it

2 tests — each concludes only on cited evidence.

SLA monitoring defined

Design
Procedure
Inspect the arrangement.
Expected
Defined.
Sample
1 (design inspection)
Evidence
SLA performance reports, escalation records.

SLA performance monitored; breaches escalated

Operating
Procedure
Inspect reports.
Expected
Managed and escalated.
Sample
Judgmental, by population (e.g. 10–25)
Evidence
SLA performance reports, escalation records.

Evidence Tess looks for

SLA performance reports, escalation records.

More in Third-Party / Vendor Management

VM-01 Vendor / Third-Party Risk Assessment VM-02 SOC Report Review (SOC 1/2) VM-03 Cloud Provider Governance (GCP) VM-04 Outsourcing Register & MAS Compliance

Want Tess to test VM-06 against your evidence?

Book a demo