Getting started with Vendors

The Vendors page tracks the third parties you depend on, each with an assessment, a calculated risk rating, and the documents that back it up. This article covers reading that overview: the statuses, how the rating is arrived at, and the tabs on a vendor.

Navigating the Vendors overview page

The Vendors page shows all vendors with their assessment status, documentation and risk ratings in a clear table.

Vendors overview

What you see in the overview:

Vendors table - All vendors with status information
Filtering options - Open vs Archived, Rating, Assignee, Status
Search functionality - Quickly find specific vendors
Add vendor button - Add new vendors
Vendor actions - Management options per vendor

Understanding the vendors table

Each row shows a vendor's name, its documents, its risk rating, and how far its assessment has got.

Column information:

Name - Vendor name and identification
Documents - Number of uploaded compliance documents (📄 4)
Rating - Risk classification (High, Medium, Low)
Assessment - Assessment status (Draft, Approved)
Approved - Approval date for compliance tracking
Assignee - Responsible person for vendor management

Example vendor information:

Microsoft | 📄 4 | Medium | Approved | 20 July 2025 | DA
GitHub   | -    | High   | Approved | 20 July 2025 | DA
Amazon   | -    | High   | Draft    | -            | DA

Filtering and searching

Filter between open and archived vendors, or narrow the list to a specific risk rating.

Open vs Archived filtering:

Open (5) - Active vendors in use
Archived (0) - Inactive vendor relationships
Switch between tabs for different vendor sets

Rating filter:

High - Critical vendors with high business impact
Medium - Standard business services vendors
Low - Minimal risk vendors

Status and Assignee filters:

Assessment status - Filter on Draft vs Approved
Assignee - Filter per responsible person
Combine filters for specific vendor sets

Recognising vendor statuses

A high-risk vendor can be Draft, and a low-risk one can be Approved; the two say different things.

Assessment status indicators

A vendor's status tracks how far its assessment has got, not how risky it is.

Draft:

New vendor in assessment phase
Assessment not completed - Questions still to answer
Documentation possibly missing
Not yet approved for use

Approved:

Assessment completed and reviewed
Compliance documentation validated
Approval date recorded
Ready for use within organisation

When status changes:

Draft → Approved after successful assessment and document review
Approved → Archived when ending vendor relationship
Status tracking for compliance audit trails

Understanding vendor ratings

The risk rating is calculated from the assessment answers rather than chosen by hand.

Risk classification system

Rating is calculated from what the vendor can access and how critical they are to your business.

High Risk:

Critical business services - Direct impact on operations
Sensitive data processing - PII, financial, health data
Legal scope - GDPR, SOX, healthcare compliance
System access - Direct access to critical systems

Medium Risk:

Standard business services - Normal operational support
Limited data access - Non-sensitive business data
Minimal system access - Controlled access levels
Standard compliance requirements

Low Risk:

Minimal business impact - Non-critical services
No data processing - Physical services, basic tools
No system access - Standalone services
Basic compliance requirements

Risk rating determination

Four factors feed the automatic rating: data access, business criticality, jurisdiction, and scope.

Factors influencing rating:

Data Access Level - What data does vendor have access to
Business Criticality - Impact on core business processes
Regulatory Jurisdiction - Compliance complexity
Service Scope - Extent of vendor services

Vendor detail panel navigation

Each vendor has an extensive detail panel with various tabs for complete information management.

Assessment tab

Vendor Assessment Tab

Risk assessment questionnaire with specific questions:

Data Access Level - "What level of access does the vendor have to our systems and data?"
Data Processing Type - "What type of data will the vendor process, store, or transmit on our behalf?"
Business Criticality - "How critical is this vendor's service to our core business operations?"
Regulatory Jurisdictions - "In which regulatory jurisdictions does the vendor operate?"
Vendor Scope - "What is the scope and scale of the vendor relationship?"

Completing assessment:

Dropdown selections for standardised answers
Mandatory vs Optional question marking
Rating calculation automatic based on answers

Details tab

Vendor Details Tab

Vendor information management:

Description - Description of vendor services
Website - Official vendor website
Vendor contact - Contact information for primary contact on vendor side
Security page - Links to security documentation
Privacy policy - Vendor privacy and data protection
Jurisdiction - Legal and compliance jurisdiction
Owners - Internal owners of vendor relationship

Documents tab

Vendor Documents Tab

Compliance documentation management:

Document upload - "Upload Document" functionality
Document types - Privacy Policy, Security Assurance, Data Processing Agreement, Vendor Contract
Upload tracking - Upload Date and Uploaded By information
Document access - Who can view and manage documents

Feed tab

The Feed tab is the audit trail: every assessment, document, status, and ownership change on the vendor.

Activities and updates tracking:

Assessment changes - Changes in risk assessment
Document updates - Upload and modification history
Status changes - Draft to Approved transitions
Owner changes - Ownership changes

Vendor management workflows

Vendor management is a rhythm rather than a one-off: a light daily check and a fuller periodic review.

Daily vendor monitoring

A quick daily check catches new drafts, expiring documents, and vendors stuck without an owner.

Routine checks:

New Draft vendors - Which assessments need completing
Document expiration - Compliance documents needing updates
Owner assignments - Vendors without assigned owners
Approval backlogs - Vendors awaiting approval

Periodic vendor reviews

On a monthly or quarterly rhythm, revisit whether assessments, documentation, and ratings still hold up.

Monthly/quarterly activities:

Update assessments - Changes in vendor services
Upload new documentation - New compliance documentation
Review risk ratings - Still accurate classification
Validate ownership - Correct owners still active

Vendor management versus ad-hoc evaluations

Vendor Management in Tidal Control enables you to systematically assess vendor risks and monitor compliance via structured workflows and documentation.

Core functionalities:

Structured risk assessments - Questionnaires for vendor evaluation
Document management - Centrally manage compliance documentation
Approval workflows - From draft to approved vendor status
Risk classification - High, Medium, Low risk categorisation
Ownership tracking - Who is responsible for which vendor

Vendor management vs ad-hoc vendor evaluations

Full vendor management is for ongoing, recurring relationships; a quick ad-hoc check is enough for a one-off.

Vendor management is ideal for:

Systematic third-party risk assessment
Compliance documentation management
Standardised vendor onboarding
Periodic vendor reviews and updates

Ad-hoc evaluations remain necessary for:

One-off project vendors
Informal vendor screening
Quick impact assessments

Next steps

Now you know the Vendor Management interface:

Inventory current vendors needing assessment
Identify risk classification criteria for your organisation
Plan document collection for compliance requirements
Develop approval workflows for efficient vendor onboarding