Business Operations SOP
Vendor & Subscription Review SOP #
This SOP defines how PrecisionTech reviews, records, monitors, and controls business vendors, software subscriptions, licensing, renewals, service dependencies, tool ownership, security exposure, and operational risks.
Purpose #
To ensure PrecisionTech’s vendors, platforms, tools, licences, subscriptions, and service dependencies remain appropriate, cost-controlled, secure, documented, and aligned with client delivery and internal business operations.
Scope #
Applies to business-critical vendors, software subscriptions, Microsoft 365 licensing, bookkeeping platforms, cybersecurity tools, domains, hosting, backup services, payment systems, documentation tools, support platforms, and client service dependencies.
Core Vendor Control Principle #
A vendor or subscription should not exist without a clear business purpose, owner, renewal awareness, access control, cost visibility, and risk review. Tools must support PrecisionTech’s operations, not create unmanaged complexity.
Vendor & Subscription Categories #
Client Delivery Tools #
Platforms used for bookkeeping, IT support, cybersecurity, remote support, client communication, reporting, and Business Care services.
Financial & Admin Tools #
Accounting platforms, payment tools, invoicing systems, payroll tools, banking-related services, and internal administration subscriptions.
IT & Cloud Services #
Microsoft 365, domains, DNS, hosting, email, storage, endpoint tools, device management, and infrastructure-related services.
Security & Backup Tools #
MFA, password management, email security, backup platforms, monitoring tools, endpoint protection, alerting, and continuity systems.
Documentation & Workflow #
SOP platforms, templates, knowledge base tools, project trackers, task management tools, document storage, and internal workflow systems.
Professional Services #
Accountants, BAS agents, legal advisers, insurers, consultants, marketing providers, contractors, and specialist support vendors.
Vendor & Subscription Review Procedure #
- Maintain the register: Record each active vendor, subscription, licence, platform, or service dependency in the approved vendor and subscription register.
- Confirm business purpose: Verify why the vendor or subscription is used and which PrecisionTech service or internal function it supports.
- Assign ownership: Each vendor or subscription must have an internal owner responsible for review, renewal tracking, access oversight, and issue escalation.
- Review cost and billing: Confirm billing frequency, cost, payment method, renewal date, price changes, duplicate subscriptions, and unused licences.
- Review access and security: Confirm administrator access, MFA, user access, password storage, offboarding control, and whether access is still appropriate.
- Review service performance: Check uptime, support responsiveness, reliability, recurring issues, vendor communication, and whether the tool remains fit for purpose.
- Review client impact: Identify whether the vendor supports client delivery, affects Business Care clients, stores client data, or creates service dependency risk.
- Review data and privacy exposure: Check whether the vendor stores financial, client, system, identity, security, or sensitive business information.
- Identify risks: Record risks relating to renewals, access control, cost increase, vendor lock-in, data exposure, backup gaps, poor support, or business continuity.
- Create action items: Assign follow-up actions for renewals, cancellation, licence cleanup, access changes, cost review, security remediation, or vendor escalation.
- Escalate critical concerns: Escalate any issue affecting client delivery, cybersecurity, financial data, business continuity, legal obligations, or owner-level decisions.
- Document the review: Update the register, action item tracker, risk register, and internal business review record where applicable.
Recommended Review Rhythm #
- Monthly: Review upcoming renewals, new subscriptions, cancelled subscriptions, billing changes, licence usage, and urgent vendor issues.
- Quarterly: Review vendor performance, cost value, access control, MFA status, client data exposure, and operational dependency risks.
- Annually: Review all vendors and subscriptions for continued business fit, price value, duplication, security posture, contract terms, and strategic alignment.
- Event-Based: Review after vendor outages, data concerns, security incidents, pricing changes, tool replacements, client onboarding changes, or service model changes.
Required Register Fields #
- Vendor or subscription name
- Category
- Business purpose
- Internal owner
- Service supported
- Client impact
- Data handled
- Admin access owner
- Billing frequency
- Renewal date
- Cost
- Status
- Risk rating
- Next review date
Cost Review Checks #
- Is the subscription still used?
- Are there unused seats or licences?
- Is the plan level still appropriate?
- Are there duplicate tools?
- Has pricing changed?
- Is the billing owner correct?
- Is renewal still required?
- Should the tool be cancelled, downgraded, or replaced?
Security Review Checks #
- Is MFA enabled for admin access?
- Are admin accounts still appropriate?
- Are old users removed?
- Is password storage controlled?
- Does the vendor store client or financial data?
- Does the vendor support access logs or audit history?
- Are backup or export options available?
- Is the vendor still safe to use?
Service Dependency Checks #
- Does the tool support client delivery?
- Would an outage affect operations?
- Is there a backup process?
- Is support responsive?
- Are critical workflows dependent on one vendor?
- Is the vendor documented in continuity records?
- Are renewal and cancellation risks known?
- Is there an alternative if needed?
Vendor & Subscription Register Template #
Vendor / Subscription Name: [Name]
Category: [Client Delivery / Financial Admin / IT & Cloud / Security & Backup / Documentation / Professional Services / Other]
Business Purpose: [What it is used for]
Service Supported: [Bookkeeping / IT Support / Cybersecurity / Business Care / Internal Operations / Other]
Internal Owner: [Name]
Admin Access Owner: [Name / Role]
Client Impact: [None / Low / Medium / High / Critical]
Data Handled: [None / Business Data / Client Data / Financial Data / Identity Data / Security Data / Sensitive Data]
MFA Enabled: [Yes / No / N/A]
Billing Frequency: [Monthly / Annual / Usage-Based / Other]
Approximate Cost: [$ Amount]
Renewal Date: [Date / N/A]
Cancellation Notice Period: [Notice period / N/A]
Status: [Active / Trial / Under Review / Replacing / Cancelled]
Risk Rating: [Low / Medium / High / Critical]
Open Actions: [Action ID(s) / None]
Next Review Date: [Date]
Review Notes: [Notes]
Renewal Decision Guide #
- Renew when the tool is still used, cost is justified, access is controlled, and it supports current business operations.
- Downgrade when the tool is useful but the plan level, licence count, or feature set exceeds current needs.
- Replace when the tool is unreliable, insecure, too costly, duplicated, poorly supported, or no longer fit for purpose.
- Cancel when the tool is unused, duplicated, no longer required, or creates more risk than value.
- Escalate when the vendor affects client delivery, security, financial data, business continuity, or contractual obligations.
Related SOPs and Records #
- Business Operations Master SOP
- Internal Business Review SOP
- KPI & Metrics Tracking SOP
- Action Item & Follow-Up Management SOP
- Operational Risk Register SOP
- Client Health Review SOP
- Incident Response SOP
- Backup Verification SOP
- Business Continuity SOP
- Documentation Standards SOP
Escalation Triggers #
- Vendor outage affects client service or internal operations.
- Vendor stores client, financial, identity, or sensitive data and security concerns are identified.
- Admin access is not controlled or MFA is missing on critical platforms.
- Renewal is approaching and the owner has not approved continuation.
- Subscription cost increases materially or becomes commercially unsuitable.
- Critical licence, domain, hosting, email, backup, or security service may expire.
- Vendor support failure affects client delivery, continuity, or security response.
- Tool replacement, cancellation, or migration requires owner-level decision.
Completion Checklist #
- Vendor or subscription recorded
- Business purpose confirmed
- Internal owner assigned
- Admin access owner confirmed
- Cost and billing reviewed
- Renewal date checked
- Licence usage reviewed
- Access and MFA reviewed
- Data handled identified
- Client impact assessed
- Vendor performance reviewed
- Risk rating assigned or updated
- Action items created where required
- Escalation raised where required
- Register updated and archived
Document Control #
Owner: PrecisionTech
Applies To: Business Operations, Vendor Management, Subscription Management, Client Service, Bookkeeping, IT Support, Cybersecurity, Business Care Plans, Risk Management, Business Continuity
Review Frequency: Monthly for renewals and urgent issues; quarterly for access, cost, vendor performance, and risk; annually for full vendor review
Last Reviewed: [Insert Date]
Version: 1.0
