I recently worked with a community bank that found itself in a situation many institutions quietly worry about. They had a full‑scope regulatory examination scheduled for October. Their vendor management program was established and generally well‑run, but the person who administered it had just gone on leave and might be out through the exam date.
Vendor oversight lived in Excel spreadsheets and shared folders rather than a dedicated platform. They also had a Board‑approved AI policy, but were still in the early stages of assessing how their vendors aligned with that policy.
What they really wanted to know was simple: Are we truly exam‑ready if our key vendor manager is unavailable?
What I saw walking in
Like many community institutions, this bank was operating with a lean team and a lot of institutional knowledge sitting in one person’s head. When that person stepped away, the risk was not just operational; it was reputational and regulatory.
If an examiner walked in and asked basic questions about vendor inventory, risk ratings, documentation, and oversight, could the remaining team confidently answer and produce evidence?
My first priority was to get a clear picture of where the program actually stood today, not where the bank hoped it was based on last year’s efforts.
Framing the work: review, not an “audit”
I deliberately framed the engagement as a vendor management review, not a formal audit.
That distinction matters.
An audit implies formal testing against specific standards and a level of assurance that didn’t fit the bank’s immediate needs. They needed practical, targeted help: establish the current state, identify exam‑critical gaps, and build a roadmap that a lean team could execute.
I structured the work in two phases:
- Phase 1 – Baseline review
In this phase, I focused on:- Confirming the list of high‑ and medium‑risk vendors and understanding how those ratings were originally determined.
- Evaluating what documentation existed: contracts, onboarding assessments, risk ratings, due diligence files, and ongoing monitoring evidence.
- Flagging vendors whose scope had grown over time. For example, a correspondent bank that added CECL modeling and profitability analytics, and asked whether the existing risk classification still matched the reality of those expanded services.
- Phase 2 – Gap analysis and roadmap
Once the baseline was clear, I:- Translated findings into specific, concrete gaps: missing or outdated documents, risk ratings that hadn’t been revisited, incomplete AI assessments, unclear accountability for certain oversight tasks.
- Prioritized which gaps had to be addressed before the October exam and which could reasonably be scheduled as post‑exam improvements.
- Built a practical roadmap with tasks, owners, and suggested timing that reflected the bank’s lean staffing and the uncertainty around the vendor manager’s return.
The result of this structure was a plan grounded in reality, not an idealized vision of a “perfect” vendor program.
Making AI policy real for vendors
One of the most important aspects in this engagement was artificial intelligence. The bank’s AI policy had been approved at the Board level, and it looked good on paper. But the bridge from Board policy to vendor practices hadn’t been fully built.
To close that gap, I helped the team:
- Review and refine an AI‑focused survey for high‑ and medium‑risk vendors.
- Ensure the questions went beyond “Do you use AI?” and dug into how AI was used, what data and models were involved, and what governance controls were in place.
- Design a simple way to take vendor responses and feed them back into risk ratings, due diligence files, and oversight plans.
The goal was to show examiners a clear line: here is our policy, here is how we assess vendors against it, and here is how those assessments are reflected in our risk management.
Working within spreadsheets and shared drives
Many institutions assume they need a new system before they can improve vendor management. In this case, I made a different choice: I worked within the bank’s existing environments- spreadsheets and shared network drives.
We focused on making what they already had more effective:
- Validating that the vendor inventory in Excel matched the reality of their relationships.
- Cleaning up folder structures and naming conventions so key documents could be located quickly under exam pressure.
- Clarifying and documenting workflows for onboarding, periodic reviews, and escalations, even without a dedicated platform.
This approach respected budget and time constraints while still improving exam readiness. It also created a better foundation if the bank chooses to adopt vendor management software in the future.
Designing for staffing uncertainty
A unique challenge in this engagement was that no one knew exactly when—or in what capacity—the vendor manager would return. Full‑time, part‑time, different roles: all were on the table.
Because of that, I designed the roadmap and my support model to be flexible. For example:
- If internal capacity remained limited, I could stay involved longer and take on more of the execution work.
- If the vendor manager returned and was ready to re‑engage, we could shift more responsibilities back to the internal team and let them drive the program using the roadmap as their guide.
- If the return came with reduced responsibilities, we could find a middle ground where internal staff handled day‑to‑day tasks, and I provided ongoing oversight and advisory support.
The key was ensuring the vendor program wouldn’t stall just because one person’s situation changed.
What the bank walked away with
By the end of the engagement, the community bank had more than “a review.” They had:
- A documented baseline of their vendor management program that reflected current reality.
- Updated risk classifications for vendors whose scope and importance had grown.
- A prioritized, realistic roadmap for closing gaps before and after the exam.
- A tangible way to show how their AI policy connects to vendor oversight.
- A stronger sense of confidence heading into their October examination, even with staffing uncertainty.
For a bank with limited bandwidth and shifting roles, that confidence—supported by real documentation and clear next steps—was invaluable.
My takeaway
Working with this community bank reinforced a belief I’ve held for a long time: you don’t need perfect tools or perfect circumstances to have a strong vendor management program. You need clarity, discipline, and a plan that fits the reality of your team.If your vendor manager went on leave 90 days before your next exam, would you be comfortable with your current vendor documentation, risk ratings, and AI oversight? If that question gives you pause, now is the right time to establish your baseline and build your roadmap—before the exam is on your doorstep.