Vendor Compliance Training Template and Checklist
A ready-to-run vendor compliance program and the rollout checklist to go with it. Train every vendor owner, then see which third parties are actually covered.
Reviewed by Abhijit Rao, AVP & Business Head, India
- A seven-module vendor compliance program, with audience and coverage for each
- A rollout checklist covering onboarding, due diligence and monitoring
- A third-party risk readiness matrix that shows where coverage is thin
- An annual calendar covering reviews, attestations and offboarding
What is inside
- A seven-module vendor compliance program covering onboarding due diligence, code of conduct, monitoring and third-party risk.
- A 10-point rollout checklist across selection, onboarding, monitoring and offboarding, to mark off as you go.
- A third-party risk readiness matrix that scores each team and shows where coverage is thin.
- An annual vendor calendar covering periodic reviews, attestations and offboarding so compliance stays continuous.
Who it is for
Anyone who has to plan what people learn, and answer for whether it landed.
- L&D and training teams
- People managers and team leads
- Heads of function and department
- HR business partners
- Compliance and risk teams
- Onboarding and enablement teams
- Operations and delivery leads
- COOs and HR directors
How to use this template in 4 steps
- Pick your format. Download the PDF to share, the Word file to edit, or the Excel file to work in live. All three are free.
- Make it yours. Adapt the sections, fields and wording to your team, roles and process so it fits how you actually work.
- Put it to work. Fill it in, circulate it to stakeholders for sign-off, or roll it out to your team.
- Track and improve. Review it on a set cadence and refine it as your goals, roles and priorities change.
What is inside
- A seven-module vendor compliance program covering onboarding due diligence, code of conduct, monitoring and third-party risk.
- A 10-point rollout checklist across selection, onboarding, monitoring and offboarding, to mark off as you go.
- A third-party risk readiness matrix that scores each team and shows where coverage is thin.
- An annual vendor calendar covering periodic reviews, attestations and offboarding so compliance stays continuous.
This pack is practitioner guidance to help you structure training, not legal advice. Third-party risk and vendor obligations vary by industry, contract and jurisdiction, so confirm your specific requirements with your compliance, procurement and legal teams.
The training program template
Seven modules covering what actually causes third-party incidents: skipped diligence, unsigned attestations and vendors nobody reviewed after go-live. Run the full set for vendor owners, then use the refresher and role-specific modules through the year.
| Module | Audience | Duration | What it must cover |
|---|---|---|---|
| 1. Why vendor risk is your risk | All vendor owners | 20 min | How a third party's failure becomes your liability, with real categories of third-party incident. |
| 2. Onboarding due diligence | Procurement, owners | 35 min | Risk tiering, KYC and beneficial ownership, financial health, security and data-protection review. |
| 3. Screening checks | Procurement, compliance | 25 min | Sanctions, watchlists, adverse media and politically exposed persons, and what a hit means. |
| 4. Code of conduct and attestations | Owners, legal | 25 min | Supplier code of conduct, anti-bribery, modern slavery and data-protection attestations, signed and stored. |
| 5. Contracts and clauses | Owners, legal | 30 min | The compliance clauses to require: audit rights, data protection, sub-processor control and breach notice. |
| 6. Ongoing monitoring and offboarding | Vendor managers | 30 min | Review cadence by risk tier, performance and incident handling, and secure offboarding with data return. |
| 7. Annual refresher | All vendor owners | 20 min | Regulatory changes, a recent anonymised third-party incident, and a short knowledge check for evidence. |
Delivering the modules and knowledge check through an LMS gives you dated completion per vendor owner and per category, the evidence an auditor or a customer security review asks for.
The rollout checklist
Ten steps to make vendor compliance run across the whole lifecycle. Tick items to track your own progress, it stays in this browser. The download has the same list with an owner column.
- Vendor owners trained before they onboard suppliersOnboardingPer owner
- Every vendor risk-tiered at selectionSelectionPer vendor
- Due diligence completed before go-liveDue diligencePer vendor
- Sanctions and screening checks runScreeningAt onboarding
- Supplier code of conduct signed and storedAttestationsPer vendor
- Data-protection and security terms in the contractContractsPer vendor
- Periodic reviews scheduled by risk tierMonitoringBy tier
- Offboarding and data return plannedOffboardingPer exit
- Coverage tracked by vendor owner and categoryGovernanceMonthly
- Annual refresher and knowledge check completedGovernanceAnnual
The most common gap is the last one. A company-wide 90 percent completion can still hide one owner onboarding high-risk vendors with no diligence at all.
Third-party risk readiness at a glance
The checklist tells you what is missing overall. This matrix tells you which teams are behind. Score each team on the five practices that decide third-party exposure. In Excel the readiness and gaps calculate as you type.
| Team | Vendors | Due diligence | Screening | Attestations | Monitoring | Offboarding | Ready |
|---|---|---|---|---|---|---|---|
| Procurement | 140 | 2 | 2 | 2 | 2 | 2 | 100% |
| IT / SaaS owners | 80 | 1 | 1 | 1 | 1 | 2 | 60% |
| Marketing agencies | 35 | 1 | 0 | 1 | 0 | 1 | 30% |
| Facilities / contractors | 50 | 1 | 1 | 2 | 1 | 1 | 60% |
| Finance / payments | 25 | 2 | 2 | 1 | 2 | 1 | 80% |
| Coverage at required | 40% | 40% | 40% | 40% | 40% | 66% |
Marketing agencies is the exposure here: no screening and no monitoring, yet these vendors often hold customer data and brand access, exactly where a third-party breach hurts.
The annual vendor review calendar
| Timing | Action | Owner |
|---|---|---|
| Before onboarding an owner | Modules 1 to 5 before they select or onboard a vendor. | L&D and Procurement |
| At every onboarding | Due diligence, screening and signed attestations before go-live. | Vendor owner |
| By risk tier | Periodic review: high tier yearly or more, low tier lighter touch. | Vendor managers |
| Monthly | Review completion by owner, overdue reviews and unsigned attestations. | Compliance |
| Annual, all owners | Refresher module and knowledge check, tracked per owner and category. | L&D |
| On a vendor incident | Targeted micro-training on the practice that failed, plus a vendor review. | Compliance |
How to run it
- Train the owners, not just publish a policy
The people who select and manage vendors need to know what due diligence to run and when.
- Risk-tier your vendors
A cloud host handling customer data needs far deeper diligence than a stationery supplier.
- Make attestations part of onboarding
Code of conduct, data protection and anti-bribery attestations signed before a vendor goes live.
- Screen and re-screen
Sanctions, adverse media and financial checks at onboarding and on a schedule after.
- Monitor across the lifecycle
Periodic reviews sized to risk tier, plus a clear offboarding and data-return step.
- Review coverage monthly
Completion by vendor owner, overdue reviews, and unsigned attestations by category.
Frontline teams reach 45 percent-plus completion on Disprz when training is delivered in short, mobile modules in the local language, the format this program is built for.
Common mistakes this pack prevents
- Publishing a vendor policy but never training the owners who actually onboard suppliers.
- A company-wide completion number that hides one owner onboarding high-risk vendors with no diligence.
- Treating every vendor the same, so a stationery supplier and a data processor get identical checks.
- Onboarding diligence done once and never repeated, so risk drifts unmonitored after go-live.
- No dated records or signed attestations, so there is nothing to show an auditor or customer.
Which format should you use?
| Format | Best for | What is inside | Editable | Size |
|---|---|---|---|---|
| Sharing and print | The full template, formatted to print or circulate | No | 55 KB | |
| Word | Editing the wording | Every section as editable text you can adapt | Yes | 86 KB |
| Excel | Filling it in live | The grid and fields set up as a working spreadsheet | Yes | 66 KB |
Questions people ask
Is vendor compliance training mandatory?
Who should take vendor compliance training?
Can I adapt the modules and checklist?
Does the Excel tracker work in Google Sheets?
Do I have to fill the form three times?
Vendor compliance only holds if the owners actually run it. That is the part we run.
Bring your procurement and vendor owners to a 30-minute working session. We will show how Disprz delivers vendor compliance training in short mobile modules and rolls completion up by owner and category, so your next audit or customer security review is a two-minute export.