How to Build a Vendor Scorecard and Tiering Model

Rate each vendor on spend, operational dependency, and switching difficulty, using a simple one-to-three scale for each. Spend is straightforward. Operational dependency asks what breaks if this vendor disappears tomorrow, a single point of failure scores high even at modest spend. Switching difficulty asks how long it would take to replace them, which is often the axis companies forget until they need it.

A vendor that's cheap but impossible to replace quickly, like a niche compliance data provider, can outrank a much larger contract on the tiering model, and that's the point: dollars spent isn't the same as risk carried. Score all three axes independently before combining them into a single tier, rather than eyeballing an overall impression, since the individual scores are what tell you where the actual exposure sits.

Three tiers are enough for almost any company:

• Tier 1: high dependency or high switching difficulty, regardless of spend. Review quarterly, with a named backup plan documented.
• Tier 2: moderate on either axis. Review twice a year, no backup plan required unless something changes.
• Tier 3: low spend, low dependency, easy to replace. Review annually or on renewal only.

More than three tiers usually just adds administrative overhead without changing what actually happens in a review, since most companies end up treating four and five the same way in practice anyway.

A Tier 1 review should answer three questions every time: is the vendor still meeting the service levels in the contract, has anything changed about their financial stability or ownership that affects reliability, and is the documented backup plan still current. Skipping the backup plan check is the most common shortcut, and it's the one that costs the most when a Tier 1 vendor actually fails, because by then it's too late to build a plan from scratch.

Bring the person who actually uses the vendor day to day into the review, not just whoever signed the contract. The finance team that negotiated the deal often can't tell you whether the service has quietly degraded, but the team using it every day usually can.

A scorecard buried in a spreadsheet nobody opens between reviews doesn't do its job. A workspace like ClickUp or Wrike can hold the tier, the next review date, and the backup plan link in one place, with a reminder that fires automatically as each review comes due, instead of relying on whoever set up the spreadsheet to remember six months later.

Revisit the tier itself, not just the review content, whenever a vendor's role changes. A supplier that started as Tier 3 and quietly became load-bearing to a core process needs to move up, and that reclassification is easy to miss if nobody's watching for it.

Payment terms are worth tracking alongside tier, since they shift by industry more than most people expect. Payables cycles run close to 63 days in computer services but only around 17 days in restaurant and dining, a gap wide enough that comparing your own terms against a generic benchmark instead of your specific sector will mislead you¹. A Tier 1 vendor with payment terms that don't match how your industry typically operates is worth a direct conversation, not an assumption that the terms are standard.