Vendor due diligence

How do we run vendor due diligence for new and renewing third parties with the questionnaires, SOC reports and contracts collected from the vendor and a risk rating approved on file?

Make the vendor a party to its own review. Callvu classifies the engagement by criticality and the data and services involved, sends the vendor the questionnaires and the document requests (the SOC report, the insurance, the financials, the business continuity plan, the subcontractor list) through links, reads what arrives, routes the information security and vendor risk reviews in the Decision Desk, records the risk rating and the approval with its conditions, and schedules the next review from the rating.

In scopeComplex: multi-party handoffsCallvu moves: chase and verify, classify, decide

Talk to an expert Try it in the sandbox

Last updated November 7, 2026.

The problem today

The vendor's SOC report is requested five times a year by five people, and the risk rating is whatever was set at onboarding.

Today, without Callvu

A business owner wants to use a new vendor. Vendor risk emails a questionnaire. The vendor returns it, partially, with last year's SOC report. Information security asks for the bridge letter. The contract is signed before the review is done because the project cannot wait. At renewal, nobody rechecks, and the critical vendor's rating is three years old.

The 2023 interagency guidance on third-party relationships expects risk-based due diligence before entering a relationship, with the depth matched to criticality: the vendor's financial condition, its information security and the SOC report with complementary user entity controls, business continuity, subcontractors, compliance, and the contract's required terms; ongoing monitoring; and board reporting on critical third parties. The evidence is the file.

Due diligence is a document-collection and review process with several parties and a schedule, which is what makes it slip.

How it runs

From the requestto the system of record.

A business owner requests a new vendor or a renewal is due on the schedule. Callvu opens the case with the engagement description and classifies it.

Business owner: Describes the engagement, the data and the services, and accepts the conditions of approval.
Vendor: Completes the questionnaires and provides the documents through links, and answers follow-ups.
Vendor risk: Owns the review, sets the rating and approves in the Decision Desk.
Information security: Reviews the security questionnaire, the SOC report and the controls in the Decision Desk.
Callvu: Classifies, collects from the vendor, reads, routes reviews, records the rating and schedules the next review.

Classify the engagement
The services, the data the vendor will access (customer information, PHI, card data), the systems it connects to, the spend and the substitutability classify the vendor's criticality tier. The tier sets the questionnaires, the documents required, the reviews and the review frequency.
Chase and verify the vendor
The vendor receives links to the questionnaires for its tier (security, privacy, business continuity, compliance, subcontractors) and the document requests (the SOC 1 or SOC 2 report with any bridge letter, the certificate of insurance, financial statements, the business continuity plan, the cyber insurance). Each document is read on arrival: the SOC report's period, opinion, exceptions and complementary user entity controls are extracted; the insurance limits are checked against the contract's requirement.
Decide the reviews
Information security reviews the security evidence in the Decision Desk and records findings and the controls the bank must operate; vendor risk reviews the rest and sets the inherent and residual risk rating. A critical vendor's approval routes to the committee the policy names. Conditions (a remediation plan, a contract term, a compensating control) are recorded with owners and dates.
Contract and write back
The contract's required terms for the tier (data protection, audit rights, business continuity, subcontracting, termination, incident notification) are checked against the executed contract, and the approval, the rating, the conditions and the documents are written to the vendor record. The next review is scheduled from the rating, and the monitoring items (SOC report expiry, insurance expiry, condition dates) run as cases of their own.

Where it ends: The vendor was reviewed to the depth its criticality requires, with the evidence on file, the rating and the approval recorded with conditions, and the monitoring scheduled. The Decision Trace shows the classification, the findings and the decisions; the Audit Trace shows every request to the vendor, every document and every review step.

Runtime enforcement

What is enforcedwhile the work runs.

The regulations preloaded in Callvu Studio and the bank's own policies, applied as steps that run, not lines in a binder. A step that breaks a rule does not run, so a completed run was compliant.

Regulations

Interagency third-party risk guidance (Interagency Guidance on Third-Party Relationships: Risk Management, June 2023): Banks are expected to manage third-party relationships through planning, due diligence and third-party selection, contract negotiation, ongoing monitoring and termination, with the depth of due diligence matched to the criticality of the activity: financial condition, business experience, legal and regulatory compliance, risk management and controls, information security, operational resilience, subcontractors and insurance. The board oversees critical third parties, and the records document each stage.
GLBA Safeguards: service provider oversight (12 CFR part 364 appendix B, section III.D): The bank exercises due diligence in selecting service providers that handle customer information, requires them by contract to implement appropriate safeguards, and monitors them, including review of audits and test results such as SOC reports.
Bank Service Company Act notice (12 USC 1867(c)): A bank notifies its regulator of certain service relationships within 30 days; the classification flags the notice where it applies.
HIPAA business associate and PCI DSS service provider requirements where the data applies: A vendor with PHI needs a business associate agreement; a vendor handling card data must show PCI compliance; the classification adds these requirements.

Company policies

The criticality tiers, the questionnaires, the documents, the reviews and the frequencies are the bank's third-party risk policy and are applied by Callvu.
No contract is executed before the review for the tier is approved, or the approval carries the conditions that allow it.
SOC report exceptions and complementary user entity controls are recorded with the bank's response.
The vendor record is the system of record for the rating, the approval and the evidence.

Controls

Criticality classification by data, services, systems and substitutability.
Vendor questionnaires and document requests by link, read on arrival.
SOC report extraction (period, opinion, exceptions, user entity controls).
Insurance and financial checks against requirements.
Decision Desk reviews by information security and vendor risk, with committee approval for critical vendors.
Contract term check against the tier's requirements.
Next review and monitoring scheduled from the rating.

Clocks and deadlines

Review before contract: The review for the tier completes before execution, or the conditions are recorded.
Review frequency: From the rating (for example annually for critical vendors), scheduled at approval.
Monitoring items: SOC report and insurance expiries and condition due dates, each as its own case.

Documents and checks

The engagement description and the classification
The questionnaires as completed
The SOC report with bridge letter, the insurance certificate, financials, business continuity plan, subcontractor list
The review findings and the rating
The approval with conditions and the contract term check

In the Decision Trace

The criticality classification and why.
Each document's checks and findings.
Each review decision and the person.
The rating, the conditions and the next review date.

In the Audit Trace

Each request to the vendor and its answer.
Each document received and read.
Each Decision Desk step.
The write to the vendor record and the schedules.

The handoff

Between the front doorand the back office.

The front door

A business owner's request or the renewal schedule. The vendor meets the process through links to its own questionnaires and document requests.

The back office

Information security and vendor risk review from assembled, read evidence in the Decision Desk; the committee approves critical vendors from the record.

The Decision Desk

Information security records findings and required controls; vendor risk sets the rating and approves with conditions; a critical vendor goes to the committee the policy names, each with only the allowed outcomes.

Proof

In scope.Proof at scale, not one process at a time.

The kind of process Callvu runs in production for customers in this industry. Ask for a reference on this exact process. The results below are the industry's published proof; each claim code links to its record on agents.callvu.com.

More than 1,000 processes are live across Callvu customers.

Across Callvu customers

Banca Transilvania automated more than 100 workflows with Callvu.

BNK-04

Bank Leumi digitized all loan application and servicing workflows within six months, and dozens more processes since.

BNK-01

Questions

What buyers ask next,answered plainly.

How does the vendor provide its documents?

Through links to its questionnaires and document requests for its tier; each document is read on arrival and the SOC report's period, opinion and exceptions are extracted.

Can the contract be signed before the review?

Not for its tier, unless the approval records conditions that allow it. The contract's required terms are checked against the executed contract.

What happens at renewal?

The next review is scheduled from the rating at approval, and SOC and insurance expiries run as monitoring cases in between.

Related processes

Operational and IT incident reporting User access provisioning and reviews Purchase and expense approvals Try it in the sandbox All banking and credit unions processes

Bring this process, or the one that costs you most.

We build it against your policies and your systems, train your team and stay with you through launch. You are live in weeks.