Does anyone have policy/procedure for vendor selection or procurement (prior to performing due diligence)? This would include guidelines surrounding:
• documentation of vendors considered, analysis or criteria used to evaluate the vendors, and the rationale for final selection
• documentation to support if only one vendor was considered (e.g. an impressive trade-show demo)
• when RFI, RFP and scoring templates are appropriate vs. a memo
• what factors might limit a vendor from consideration, if any (e.g. a small, offshore, start-up company)
• and, which products/services or criteria would trigger these vendor selection guidelines; such as risk, cost, complexity

Any informal guidelines or feedback would be welcomed - thank you!

It appears you may be starting from scratch. So here is where I would start:

-Tell us how large the bank is you work for, this may provide help with feedback.
-If your institution is 500M then you probably do not want a vendor management program from a 3 billion dollar bank.
-Start with identifying your high risk vendors. Ones you are currently using, such as your core processor and maybe some areas in the IT area.
-Refer to the IT examination procedures related to vendor management and start the process there.

As a $3 billion FI, we have a fairly mature and robust vendor management program for our existing vendors and onboarding new ones.
We need a more standardized process for SELECTING new vendors.