From Vendor Due Diligence to Vendor Governance: What Ongoing Oversight Should Look Like

Approving a vendor is one decision. Maintaining confidence in that vendor over time is an entirely different responsibility.

Investment firms depend on third-party technology and service providers to support critical compliance activities. Portfolio monitoring platforms, order management systems, trade surveillance solutions, employee trading systems, and data providers are often embedded in the daily operations of an investment compliance program.

Yet many firms devote considerably more attention to evaluating vendors before implementation than to overseeing them afterward.

A vendor may successfully complete an extensive due diligence process, demonstrate strong controls, and meet every requirement at onboarding. But what happens when its technology changes, its services expand, its data sources shift, or its performance begins to deteriorate?

This is where investment vendor governance becomes essential.

For Chief Compliance Officers (CCOs), Chief Operating Officers (COOs), and investment compliance leaders, effective vendor oversight requires more than periodic questionnaires or contract renewals. It requires a structured, ongoing process for evaluating performance, managing changes, documenting decisions, and ensuring that third-party relationships continue to support the firm’s compliance obligations.

The objective is not simply to confirm that a vendor remains acceptable. It is to establish confidence that the controls and services the firm relies upon continue to function as intended.

Why Vendor Due Diligence Is No Longer Enough

Vendor due diligence typically focuses on assessing a prospective provider before entering into a relationship. Investment firms evaluate capabilities, security practices, financial stability, service delivery, and compatibility with internal requirements.

These assessments are important. However, they represent a snapshot of the vendor at a particular point in time.

Once a vendor becomes part of the firm’s investment compliance infrastructure, new risks can emerge.

Consider a portfolio compliance monitoring platform that undergoes a significant software update. The vendor may introduce new functionality, modify data-processing logic, or change how investment restrictions are evaluated.

From the vendor’s perspective, these changes may represent improvements. From the investment firm’s perspective, they could affect how compliance rules execute, how exceptions are identified, or how monitoring results are documented.

Similarly, a market data provider might modify a classification methodology that feeds portfolio restriction monitoring. Without appropriate oversight, the investment compliance team may not recognize the downstream impact until a monitoring discrepancy or examination raises questions.

The distinction is straightforward:

Vendor due diligence determines whether a provider is suitable at the time of selection or reassessment.
Vendor governance establishes how the firm continuously evaluates, monitors, and manages the relationship throughout its lifecycle.

A strong governance program incorporates due diligence, but it does not end there.

The SEC’s Expectations Reinforce the Importance of Ongoing Oversight

For registered investment advisers, vendor governance should be considered within the broader framework of compliance program effectiveness.

Under Rule 206(4)-7 of the Investment Advisers Act, registered advisers must adopt and implement written policies and procedures reasonably designed to prevent violations of the Advisers Act and its rules. They must also review their policies and procedures at least annually.

Importantly, the SEC’s adopting release discusses considering interim reviews when significant compliance events or changes in business arrangements occur.

This principle has practical implications for vendor relationships.

When a third-party system supports a firm’s investment compliance controls, changes to that system may warrant additional review rather than waiting for the next scheduled assessment.

The SEC’s 2026 Examination Priorities also identify operational resiliency, information security, governance practices, and third-party vendor oversight as areas of examination focus, including in the context of applicable Regulation S-P requirements.

These priorities reinforce the importance of understanding how external dependencies affect a firm’s ability to maintain effective controls.

An important distinction: the SEC withdrew its proposed investment adviser outsourcing rule in June 2025. The withdrawn proposal should not be characterized as an adopted, standalone vendor governance requirement. Nevertheless, existing compliance obligations and applicable requirements concerning information security, recordkeeping, and supervision remain relevant to vendor-supported activities.

For investment compliance leaders, the central question is not whether every vendor must follow an identical oversight checklist.

It is whether the firm can demonstrate that its oversight is appropriate for the risks, responsibilities, and operational dependencies associated with each relationship.

What Effective Vendor Governance Looks Like in Investment Compliance

A mature vendor governance framework should connect vendor oversight to the investment compliance activities each provider supports.

The following six components establish a practical foundation.

1. Maintain a Risk-Based Inventory of Compliance Vendors

Effective oversight begins with understanding which vendors support critical investment compliance functions.

Not every third-party relationship presents the same level of risk.

A vendor responsible for portfolio guideline monitoring has a different operational impact than a provider supporting a limited administrative workflow. Likewise, a system used to monitor employee personal trading may present different risks than a provider of investment classification data.

Investment firms should maintain a centralized inventory that identifies:

The vendor and services provided.
The investment compliance processes and controls supported.
The internal business owner and compliance oversight contact.
The types of information accessed, processed, or stored.
The vendor’s importance to critical monitoring activities.
Material integrations and upstream or downstream dependencies.
The vendor’s assigned risk tier and reassessment schedule.

Risk classifications should consider more than cybersecurity exposure.

For investment compliance, firms should also evaluate the consequences of inaccurate monitoring results, missed investment restrictions, incomplete exception reporting, unavailable records, and disruptions to critical compliance workflows.

For example, an outage affecting a platform used for pre-trade compliance checks could have an immediate operational impact. A reporting tool that is unavailable for several hours may present a different level of urgency.

Risk-based classifications help determine how much oversight each relationship requires.

2. Establish Clear Ownership and Accountability

Vendor oversight frequently involves multiple departments, including compliance, operations, technology, information security, procurement, and legal.

Shared involvement is necessary. Unclear accountability is not.

A common weakness occurs when each department assumes another team is responsible for monitoring changes or following up on unresolved issues.

Investment firms should identify specific responsibilities for each material vendor relationship.

For example:

Responsibility	Potential Owner
Contract management and service delivery	Operations or vendor management
Investment compliance control effectiveness	Compliance
Technical integration and system performance	Technology
Information security assessment	Information security
Material change approval	Designated cross-functional owners
Issue escalation and remediation tracking	Assigned vendor owner with compliance participation

The specific organizational structure will vary.

What matters is that ownership is documented, decisions are traceable, and material issues reach the individuals authorized to evaluate their implications.

CCOs should not automatically become the operational owners of every compliance-related vendor.

Instead, compliance should have defined authority and visibility when vendor activity could affect investment restrictions, monitoring accuracy, supervisory processes, or required records.

3. Monitor Performance Against Compliance-Critical Expectations

Traditional vendor management often emphasizes service-level agreements, system uptime, support response times, and contract performance.

These metrics matter, but they do not necessarily demonstrate whether a vendor continues to support effective investment compliance.

A system can meet its uptime commitments while producing incomplete or inaccurate monitoring results.

Investment firms should therefore evaluate both operational performance and compliance control effectiveness.

Relevant indicators may include:

Accuracy and completeness of compliance monitoring outputs.
Timeliness of exception generation and escalation.
Data feed reliability and reconciliation results.
Frequency and impact of system defects.
Timeliness of issue resolution.
Completeness of audit trails and supporting records.
Results of periodic control testing.
Frequency of unplanned changes affecting monitoring workflows.

Consider a trade surveillance platform that consistently delivers reports on schedule but experiences recurring gaps in transaction data.

From a service delivery perspective, the vendor may appear to be performing adequately. From an investment compliance perspective, the incomplete data could undermine surveillance effectiveness.

This is why vendor governance must evaluate the actual controls and outcomes that investment compliance teams depend upon.

Performance reporting should also distinguish between vendor failures, internal configuration issues, and data quality problems originating elsewhere in the firm’s technology environment.

Without that distinction, firms risk directing remediation toward the wrong party.

4. Build Vendor Change Management Into the Oversight Process

Vendor changes are among the most significant reasons that initial due diligence cannot substitute for ongoing governance.

Investment compliance systems rarely remain static.

Providers introduce software releases, modify interfaces, update calculation methodologies, integrate new capabilities, and sometimes change underlying technology providers.

Each change can introduce new dependencies or affect existing controls.

For example, an update to a compliance platform might alter:

Rule calculation logic.
Security classifications.
Exception prioritization.
User access permissions.
Reporting formats.
Data retention functionality.
Interfaces with order management or portfolio accounting systems.

A documented change management process should determine which changes require notification, impact assessment, testing, approval, and post-implementation validation.

Not every software release requires extensive review. However, changes affecting compliance-critical functionality should receive attention proportionate to their potential impact.

For material changes, firms should be able to answer:

What changed, and when?
Which investment compliance controls or processes could be affected?
Who evaluated the potential impact?
What testing or validation occurred?
Were any exceptions identified and resolved?
Who approved the change, and where is that decision documented?

This approach connects vendor change management to the firm’s broader compliance control environment.

It also helps prevent situations in which a vendor introduces a change that is technically successful but operationally disruptive.

5. Create Formal Escalation and Remediation Procedures

No vendor relationship operates without occasional issues.

The effectiveness of a governance framework depends partly on how the firm identifies, evaluates, escalates, and resolves those issues.

A recurring data problem, delayed monitoring report, or unresolved system defect should not remain indefinitely within informal email exchanges.

Investment firms should establish escalation criteria based on severity, operational impact, and potential compliance consequences.

A practical framework might distinguish among:

Routine issues: Limited service disruptions or isolated defects with minimal impact on compliance activities.

Significant issues: Recurring failures, incomplete monitoring data, or control weaknesses requiring formal remediation and management attention.

Critical issues: Failures that materially impair compliance monitoring, prevent required controls from operating, or create an immediate need for contingency procedures.

For significant and critical issues, the firm should document the problem, assess its impact, assign an owner, establish remediation expectations, and verify resolution.

Where necessary, compensating controls should be implemented while the underlying problem remains unresolved.

For instance, if a compliance monitoring vendor experiences a defect affecting a particular investment restriction, the firm may need temporary manual review procedures until the system is corrected and validated.

The critical distinction is that identifying an issue is not the same as resolving the associated risk.

Effective governance requires evidence that remediation occurred and that affected controls are operating as intended.

6. Maintain Documentation That Supports Examination Readiness

Vendor governance is only as defensible as the evidence supporting it.

Investment compliance teams may have extensive discussions with vendors, conduct periodic reviews, and resolve issues successfully. However, if those activities are not documented, reconstructing decisions during an examination can become difficult.

The SEC’s guidance on examiner oversight of annual compliance reviews highlights the importance of evaluating both the work performed and the documentation supporting compliance reviews.

For material vendor relationships, a well-maintained governance record may include:

Initial and subsequent due diligence assessments.
Risk classifications and documented rationale.
Assigned ownership and oversight responsibilities.
Service reviews and relevant performance metrics.
Material change assessments and testing results.
Issues, escalations, and remediation evidence.
Meeting records and material vendor communications.
Contract renewals and reassessment decisions.
Contingency plans and exit considerations.

Documentation should be proportionate to the relationship and aligned with applicable recordkeeping obligations and internal policies.

The objective is not to create unnecessary administrative work.

It is to preserve a clear record of how the firm evaluated risks, made decisions, and responded when circumstances changed.

How Often Should Investment Firms Review Their Vendors?

There is no single review frequency appropriate for every investment compliance vendor.

A risk-based approach is generally more effective than applying the same annual questionnaire to every provider.

For example, a firm might establish the following internal review cadence:

Vendor risk level	Illustrative oversight approach
Critical	Ongoing performance monitoring, quarterly governance reviews, annual formal reassessment, and event-driven reviews
High	Regular performance monitoring, semiannual governance reviews, and annual reassessment
Moderate	Annual review with event-driven reassessment
Low	Periodic review based on the firm’s risk methodology

These intervals are illustrative governance practices, not SEC-prescribed review frequencies.

Importantly, the frequency of a formal vendor assessment should not be confused with the frequency of monitoring the compliance controls that vendor supports.

A critical pre-trade compliance platform may require daily operational checks even if its broader vendor relationship is formally reviewed quarterly.

Investment firms should also establish event-driven review triggers.

Examples include significant technology changes, security incidents, material service failures, ownership changes, new subcontracting arrangements, expanded data access, or repeated compliance control deficiencies.

This ensures that vendor oversight responds to changes in actual risk rather than relying exclusively on the calendar.

The Role of the CCO and COO in Vendor Governance

Vendor governance becomes more effective when compliance and operations leadership approach it as a shared business responsibility.

The COO typically brings visibility into operational dependencies, service delivery, technology investments, and resource allocation.

The CCO evaluates how those dependencies affect the firm’s compliance obligations, monitoring processes, and control effectiveness.

Neither perspective is sufficient on its own.

A vendor may offer significant operational efficiencies while introducing monitoring limitations that compliance has not evaluated.

Conversely, a compliance team may identify a control concern without understanding the technical or contractual constraints affecting remediation.

Cross-functional governance helps connect these considerations before they become larger problems.

For CCOs and COOs, useful oversight questions include:

Which vendors are essential to our investment compliance program?
Do we know which controls depend on each provider?
Who is responsible for evaluating material vendor changes?
How do we validate that vendor-supported monitoring remains accurate?
Are recurring issues visible to the appropriate leadership?
Can we reconstruct significant decisions and remediation activities?
What would happen if a critical vendor became unavailable tomorrow?

These questions shift the discussion from whether the firm completed a vendor review to whether it understands and manages its ongoing dependencies.

Common Vendor Governance Gaps Investment Firms Should Address

Even established investment organizations can develop gaps between formal vendor management processes and day-to-day compliance operations.

Three areas deserve particular attention.

Vendor Oversight Exists, but Compliance Is Not Fully Involved

Procurement or technology teams may manage vendor reviews without consistently involving investment compliance personnel.

As a result, assessments may focus on financial stability, cybersecurity, and contract performance while overlooking changes affecting portfolio restrictions, surveillance, or investment compliance reporting.

The solution is not to duplicate vendor management activities. It is to define when compliance participation is required and what evidence compliance needs to evaluate.

The Firm Monitors Service Levels but Not Control Effectiveness

Strong service metrics can create a misleading sense of confidence.

Investment compliance teams need visibility into whether vendor-supported controls produce complete, accurate, and timely results.

This requires periodic validation of monitoring outputs, data dependencies, and exception workflows, not simply confirmation that the platform is available.

Vendor Issues Are Resolved Without Preserving Institutional Knowledge

When vendor problems are managed through informal conversations, the firm may lose important context when personnel change.

A future reviewer may be unable to determine why an issue occurred, how its impact was evaluated, or whether corrective action was validated.

Centralized issue tracking and documented decisions help preserve that knowledge and reduce the risk of recurring problems.

A Practical Roadmap for Moving From Due Diligence to Vendor Governance

Investment firms do not necessarily need to implement an entirely new governance platform to improve oversight.

A focused approach can begin with existing systems, processes, and relationships.

Step 1: Identify critical vendors. Start with providers supporting portfolio monitoring, trade surveillance, employee trading, investment data, and other material compliance activities.

Step 2: Map dependencies. Document which controls, systems, data feeds, and business processes rely on each provider.

Step 3: Assign accountability. Confirm ownership across compliance, operations, technology, and other relevant functions.

Step 4: Define oversight requirements. Establish risk-based performance metrics, review schedules, escalation criteria, and change notification expectations.

Step 5: Evaluate existing gaps. Determine whether the firm has sufficient visibility into vendor performance, system changes, unresolved issues, and control validation.

Step 6: Establish a documented governance cycle. Bring performance monitoring, material change assessments, issue management, and periodic reassessments into a repeatable process.

Step 7: Test the framework. Select a critical vendor and determine whether the firm can reconstruct its most recent material change, associated impact assessment, approvals, and testing evidence.

That final exercise is particularly valuable.

A governance framework should not be measured solely by the completeness of its policies. It should be evaluated by whether the firm can demonstrate that those policies work in practice.

Frequently Asked Questions About Investment Vendor Governance

What is the difference between vendor due diligence and vendor governance?

Vendor due diligence evaluates a provider’s suitability and risks at a particular point in time, often before selection or renewal. Vendor governance is the ongoing process of monitoring performance, managing changes, assigning accountability, addressing issues, and periodically reassessing the relationship.

Does the SEC require investment advisers to monitor third-party vendors?

Investment advisers are subject to applicable compliance obligations, including Rule 206(4)-7, and certain vendor-related requirements may apply under rules such as Regulation S-P. The SEC withdrew its proposed investment adviser outsourcing rule in 2025. Firms should assess vendor oversight in relation to their existing obligations and the risks associated with outsourced or vendor-supported activities.

Which investment compliance vendors require the most oversight?

Providers supporting critical investment compliance activities generally warrant greater attention. Examples include pre-trade compliance platforms, portfolio restriction monitoring systems, trade surveillance providers, employee trading monitoring systems, and vendors supplying data essential to compliance controls.

How can investment firms improve vendor governance without adding unnecessary complexity?

Start by identifying critical vendors, assigning clear ownership, defining material change triggers, monitoring compliance-related performance, and documenting decisions. Existing governance and issue management workflows can often be strengthened before new technology is introduced.

Building a More Defensible Vendor Governance Framework

Investment firms increasingly depend on third parties to support essential compliance activities. That dependence makes ongoing vendor oversight an important component of a sustainable investment compliance program.

Due diligence establishes an initial foundation of confidence. Governance determines whether that confidence remains justified as vendors, technologies, and business requirements change.

For CCOs and COOs, the goal should be a framework that provides visibility into vendor-supported controls, clearly assigns accountability, identifies material changes, and produces evidence of effective oversight.

Strong vendor governance does not eliminate third-party risk. It enables investment firms to recognize, evaluate, and manage that risk before it undermines compliance effectiveness.

How TillieStar Can Help

At TillieStar, we specialize in helping investment organizations strengthen the processes, technologies, and governance structures supporting their investment compliance programs.

Our experience across investment compliance systems and operational workflows enables us to help firms identify control dependencies, evaluate vendor-supported processes, strengthen oversight procedures, and improve the documentation needed to support effective governance.

Whether your organization is reassessing existing compliance technology, addressing gaps in vendor oversight, or building a more scalable compliance operating model, TillieStar can help connect governance expectations to practical execution.

Ready to strengthen your investment compliance vendor oversight?

Contact TillieStar at sales@tilliestar.com or (617) 865-3550 to discuss your firm’s needs and schedule a discovery call.