A working dashboard that scores vendor risk across six dimensions, tracks governance cadence, and generates committee-ready briefs using the Claude API — built to bridge a functional gap between PMO delivery management and vendor risk oversight.
Two views — the vendor register sorted by risk exposure, and the AI-generated governance brief ready for committee review.
Control Manager and Vendor Risk roles in financial institutions require translating raw vendor data — SLA rates, due diligence ages, contract proximity, financial health — into prioritised governance positions. That translation is where PMO skills fall short of what the role demands.
Most vendor dashboards surface data. Few help a manager answer the question a risk committee actually asks: which vendors need attention right now, and why?
VendorLens applies a six-factor weighted risk model to each vendor in the register, producing a score that reflects governance exposure rather than just operational performance. The AI layer then reads those scores and produces a structured brief — Vendor Overview, Risk Summary, Key Concerns, Recommended Actions, Governance Status — in the language a Control Manager would use.
The output is designed to be copied directly into a committee pack, not into a developer's inbox.
The common proxy for vendor health is SLA compliance. It is the easiest metric to pull and the one most dashboards default to. But a vendor can be 95% SLA-compliant while operating on an expired contract, with a due diligence that is two years stale, and a financial health score that signals instability. Each of those facts individually is a governance concern. Together, they represent an unacceptable risk position — and averaging them into one number would obscure that.
The model below treats each dimension as a separate signal, weighted by how directly it contributes to regulatory or operational exposure. Concentration risk and governance cadence carry more weight than open issue count because their consequences are harder to recover from quickly.
Scores range 0–100. A vendor can score 81 with a 78% SLA rate — lower than a vendor scoring 52 with 94% SLA. That is intentional: the 81 also has an expired contract, a due diligence gap of over two years, and five open issues. The score reflects the full governance picture.
| Factor | Weight | Rationale |
|---|---|---|
| SLA Compliance | 25% | Operational reliability is the most visible indicator of service quality. Vendors below 85% are treated as materially non-compliant. |
| Financial Health | 20% | Low financial health signals vendor instability and potential service disruption. Critical for any vendor providing essential or sensitive services. |
| Concentration Risk | 20% | High dependency on a single vendor amplifies the impact of any failure. Assessed as High / Medium / Low based on service criticality and substitutability. |
| Governance Cadence | 20% | Missed review cycles are a direct control failure. An overdue cadence is treated as a binary trigger — it adds a fixed penalty regardless of other scores. |
| Contract Proximity | 10% | Contracts expiring within 90 days require active management. Expired contracts contribute maximum score — operating without a contract is itself a governance breach. |
| Open Issues | 5% | Each unresolved issue adds to exposure. Four or more open issues are treated as a high-risk indicator regardless of their individual severity. |
Built as a single React component with no backend — all state lives in the client, vendor data is hardcoded JSON, and the only external call is to the Claude API when a brief is requested. This keeps the demo self-contained and deployable as a static file.
The tool is an argument, not just a demo. Each design decision maps to a capability a vendor risk or control manager is expected to have.