IT vendor management
Published 22 September 2026
Everything written on this subject assumes a procurement function, a contracts database and somebody whose actual job it is. Most infrastructure teams have none of those and are doing the work anyway: in an inbox, from memory. The expensive failure is nearly always the same one: a contract renewed itself because nobody diarised the notice period.
This is not the procurement version
Search for vendor management and you get material written for a category manager at a firm with a supplier onboarding workflow. Useful, if that is where you sit. It is not where most of the people doing IT vendor management actually sit.
The reader here is one engineer, or three, who also own the network, the backups and the phone system. Nobody assigned this: it arrived attached to the kit, and it amounts to perhaps fifteen companies, forty dates and a great deal of undocumented memory. Supplier scorecards do not touch any of that.
Start with the list you do not have
Ask a small IT team to name their vendors and you get the obvious six. The real list is usually double that, because it includes the ones nobody counts as vendors: the domain registrar, the certificate issuer, the firm that holds the fibre cross-connect, the last licence for the software running the door entry system.
Building it takes a couple of hours and is the highest-value thing on this page. Twelve months of card and bank statements will find most of it: anything recurring is a vendor, including the $9 subscription that now underpins something important, and the DNS zone finds the rest, because every name points at somebody you are paying. Then record, per vendor:
| Field | Why it earns its place |
|---|---|
| Company and account number | Every support call opens with it |
| Named contact, plus their manager | The escalation path, found before you need it |
| Contract end date and notice period | The two dates that cost money |
| What the contract covers | Which sites, which kit: rarely all of it |
| Support entitlement and response time | What you are actually owed at 2am |
| Portal URL and who holds the login | The thing you cannot find during an outage |
| Current annual spend | Turns a renewal into a decision |
Seven fields. A spreadsheet holds that perfectly well, and a spreadsheet you maintain beats a system you abandoned.
The contract that renewed itself
The most common mistake here, and the most expensive. A typical support or service agreement runs for a fixed term and renews automatically unless one side gives notice: commonly 30, 60 or 90 days before the term ends. So there are two dates, and the one everybody writes down is the wrong one. People diarise the expiry. By the time that reminder fires, the notice window has closed and the next term has begun.
Diarise the notice deadline, not the end date. If a three-year contract ends on 30 June 2027 with 90 days' notice, the date that matters is 31 March 2027, and the reminder belongs a month before that, because deciding needs a comparison quote and somebody's approval, neither of which happens in a week.
Two details catch people out. The renewal term is often as long as the original, so missing the window on a three-year agreement costs three years, not a month. And the renewal price is frequently not the price you have been paying; uplift clauses are normal and applied without a phone call.
Terms vary by contract and by jurisdiction, and some places treat automatic renewal differently for consumers than for businesses. None of this is legal advice. Read the termination clause of your own agreements: it is usually one paragraph, and knowing what it says is the entire defence.
Quotes, POs and RMAs
Three documents, three ways money leaks out, all failing for the same reason: each has a clock on it that nobody is watching.
- The quote that expired. Quotes carry a validity period, often 30 days and sometimes 14, and approval routinely takes longer. The quote lapses, the order goes in against it anyway, and the invoice arrives at current pricing. Record the expiry the day it arrives, and if approval will be slow, ask for the price to be held in writing.
- The PO that does not match the quote. Part numbers drift when a line is substituted for a newer revision, and the mismatch surfaces months later on a support call, when the serial on the floor is not the serial on the contract.
- The RMA nobody tracked. Faulty hardware goes back under advance replacement and the credit note becomes somebody else's problem. Nobody chases it, the vendor does not remind you, and months later you are invoiced for the unit you returned. An RMA needs a dispatch date, a tracking number and a reminder two weeks out. The RMA process for IT hardware covers the return deadlines and what goes in the box.
Support entitlement that lapsed quietly
A switch fails at 7am, you open a case, and the vendor tells you the contract on that serial ended fourteen months ago. The kit never stopped working, so nothing announced the lapse.
Entitlement attaches to serial numbers rather than to the organisation, which is why it drifts out of sync with reality: kit moves between sites, spares get pressed into production, and a batch bought a year later sits on a different cycle. Reinstating cover after a lapse is often dearer than maintaining it, because some vendors charge back the uncovered months.
The annual check is dull and short: export the serial list from the vendor portal, compare it to what is racked, and look for production kit with no cover, and for cover being paid on kit decommissioned two years ago. The second is common, and it is a refund conversation.
What was said on the call
An account manager tells you the migration fee will be waived. Eight months later the invoice includes it, that person has moved on, and there is no record. You are arguing from memory against a document.
An interaction log is the least fashionable item here and the one that pays off in the worst moments. Date, who, channel, and the one sentence that matters: three lines, and only for calls where something was promised, quoted or agreed. Routine support chatter does not belong in it.
Where something material was agreed verbally, confirm it by email the same day: "confirming our call: the migration fee is waived." That email is the record; the log only points at it.
The renewal calendar
Everything above reduces to a handful of dated reminders, and a calendar is sufficient provided the entries are right. The lead times exist so a reminder arrives while you still have options.
| What | Remind at | If you miss it |
|---|---|---|
| Contract notice deadline | 30 days before the deadline | A full new term at a new price |
| Support or maintenance expiry | 90 days before | Unsupported kit, plus reinstatement fees |
| Licence or subscription renewal | 60 days before | Less leverage, and sometimes a service stop |
| Quote validity | 7 days before it lapses | Re-quote at current pricing |
| RMA dispatched | 14 days after | Credit never arrives |
| Certificate expiry | 30 days before | An outage during business hours |
Certificates are on the list deliberately: same failure, a dated thing that stops working while nobody is looking, and the one most teams have already learned to watch. The SSL checker reads the expiry off a live host.
Two things matter more than where the calendar lives: reminders go to a shared mailbox rather than one person, and each entry carries the account number and contract reference, so acting on it does not start with hunting for the file.
What is not worth recording
The honest reason these systems go unused is that somebody made them too heavy. Every field added goes stale, and a vendor record that is 40% wrong is worse than none, because people stop trusting it and go back to the inbox. At this scale, leave out:
- Supplier scorecards and weighted ratings. With fifteen vendors you already know which ones are good.
- Every email thread. Mail is already searchable. Log the commitments, not the correspondence.
- Per-vendor risk registers. Unless a compliance questionnaire is asking, this is documentation written for an audience that does not exist.
The test for any field: has it been read in the last year, and did reading it change anything?
When one person holds all of it
This is how vendor management for IT fails in small organisations, and it is rarely anyone's fault. One engineer knows which contracts auto-renew, which account manager answers, which quote was verbal and which RMA is outstanding. None of it is written down because they have never needed it written down. Then they are on holiday during a renewal window, or they leave, and the organisation cannot answer basic questions about its own commitments: followed by months of reconstruction from invoices, usually after something has already renewed.
The mitigation is not a policy document. It is that the seven fields, the calendar and the log live somewhere a second person can open, and that the second person has opened it once. A shared drive does this; a folder on one laptop does not.
A vendor management process small enough to survive
A vendor management process that takes an hour a month gets done. One that takes a day a quarter gets skipped twice and abandoned. This is deliberately the smallest version that still catches the failures above.
- Once, to start: build the vendor list, find every contract end date and notice period, and put the notice reminders in the calendar. A long afternoon.
- When anything arrives: a quote, contract or RMA gets its date into the calendar the same day. Two minutes, and everything else depends on it.
- After any call where something was promised: three lines in the log, and a confirming email if it was material.
- Monthly: read the next ninety days of reminders and chase any open RMA. Fifteen minutes.
- Annually: reconcile entitlement against what is racked, and check recurring payments for anything you no longer use.
Step two is the one that matters. Almost every failure here is a date that was never written down, rather than one written down and ignored. If you adopt nothing else, enter the notice deadline the day a contract is signed, while the clause is still on the screen.
Done consistently, a contract renewal stops being an event that happens to you and becomes a decision you make on a date of your choosing, with a comparison quote in hand. Everything else here is bookkeeping for that.