The Vendor Oversight Decision Tool

A simple way to decide when vendor oversight should happen

Most vendor oversight models are not chosen. They’re inherited.

This tool is designed to change that. Before work starts, use these five questions to decide what level of oversight is proportionate, and when you actually need confidence.

Step 1: How critical is the output?

• Will this vendor generate data that directly influence study conclusions or regulatory decisions?

• Would failure create significant delay, cost, or reputational risk?

If the impact is high, early confidence matters more.

Step 2: How well do we know this vendor?

• Is this a new vendor, or one we have recent, relevant experience with?

• Is our confidence based on evidence, or familiarity?

If the vendor is new or uncertain, relying on assumptions increases risk.

Step 3: What kind of confidence do we need?

• Do we need to know the system is designed appropriately?

• Or do we need evidence that it is actually working in practice?

Confidence in design is not the same as confidence in execution.

Step 4: When do we still have meaningful choice?

• Could we realistically change vendor if serious concerns were identified?

• Has the study already started, or is commitment already high?

If your ability to act later is limited, earlier oversight becomes more valuable.

Step 5: What is driving our current approach?

• Are we choosing this model deliberately?

• Or are timelines, procurement, or operational momentum making the decision for us?

• Have QA and operations explicitly agreed the level of risk being accepted?

If the decision hasn’t been discussed, the risk hasn’t been owned.

Choosing your oversight model

Use your answers to guide the approach:

Option 1: Pre-qualification audit + early in-study audit

Use when:

• Data are critical

• Vendor is new or uncertain

• You need confidence in both system design and real-world performance

Outcome: Highest confidence, higher upfront effort, lowest downstream risk

Option 2: Pre-qualification audit only

Use when:

• Confidence is needed before award

• Risk is moderate

• It is acceptable to rely initially on system design

Outcome: Confidence in capability, limited early insight into execution

Option 3: Early qualification audit (after work starts)

Use when:

• Pre-award audit is not proportionate or feasible

• Early real data will provide meaningful assurance

• You accept the risk of discovering issues after work begins

Outcome: Strong evidence of performance, but reduced flexibility if issues arise

A final check

Before you proceed, ask:

“If we discover a serious issue, what will we actually do?”

If the answer is unclear, or the options are limited, your oversight may already be too late to influence the outcome.

One action for this month

Before your next vendor is selected, introduce a simple checkpoint:

“Have we agreed our oversight approach, and the risk we’re accepting, before work begins?”

It’s a small shift, but it changes the role of QA from reacting to decisions, to shaping them.