Vendor Due Diligence Is the Real Job for an RIA's Procurement

A typical SEC exam vendor-management request wants to see the firm's vendor risk assessment process, evidence that new vendors handling client data or funds were reviewed before onboarding, and a record of who approved that decision and when. A firm that can only produce vendor invoices, with no record of a pre-purchase review, is answering half the question. The other half, proof that someone evaluated the vendor's data security and access to client information before signing, has to live somewhere, and a spend platform's approval history is one of the more natural places to keep it if the approval step is built to capture it.

Procurify's default behavior, requiring a request and approval before a purchase clears, naturally creates the kind of pre-purchase record an examiner wants: who requested the vendor, who approved it, and when, all timestamped before money moved. Adding a required field for data access level, does this vendor touch client PII, account data, or trading systems, turns that approval record into something closer to the due diligence documentation compliance actually needs, rather than a generic purchase log.

Not every purchase an RIA makes touches client data or carries compliance risk, office supplies, a scheduling tool, conference registration fees. For that category, Airbase's card-first speed is a reasonable fit, because forcing every low-risk purchase through a compliance-grade review wastes the compliance team's attention on things that don't need it. The discipline is in the split: know which vendor categories actually carry data or fiduciary risk and route only those through the slower, request-first, documented path.

Say the firm wants to add a new market data feed to support a growing set of client portfolios. If that request routes through Procurify with a required data-access field, the compliance officer sees, before the vendor is engaged, exactly what data the feed will touch and can document the review. If the same purchase happens on a card with no structured review step, the compliance record for that vendor relationship might not exist at all until someone builds it retroactively for an exam, usually under time pressure and with gaps that are hard to fill months later.

Some firms do a careful review when a vendor is first onboarded and then never revisit it, even as the vendor's role or data access expands. A market data provider that starts as a read-only feed but later gets connected to portfolio rebalancing logic has taken on a materially different risk profile, and that change deserves its own review, not a pass based on the original onboarding. Building a periodic vendor review, annually at minimum for anything touching client data, into the approval platform's calendar is what turns a one-time compliance check into an actual ongoing control.

The single most useful change most RIAs can make to either platform is adding one required question to the purchase request form: does this vendor touch client PII, account data, custodial credentials, or trading systems? A vendor that answers yes gets routed to the compliance officer for review before approval; a vendor that answers no can move through the standard operating-spend approval path. That one field, consistently required, does more to satisfy an examiner's due diligence question than any amount of after-the-fact documentation, because it captures the risk assessment at exactly the moment it matters, before the relationship starts.

Firms that skip this step often find, during an exam, that they can produce a general vendor list but can't easily separate which vendors actually touch client data from which don't, which turns a routine document request into a scramble to reconstruct that distinction under time pressure.

Build the data access question into every request:

• Add one required field asking whether the vendor touches client PII, account data, custodial credentials or trading systems.
• Route any yes answer to the compliance officer for review before approval, so the review is documented before the vendor is engaged.
• Let vendors that answer no move through the standard operating-spend path without compliance sign-off on each purchase.
• Trigger a fresh review when a vendor's role or data access expands, instead of relying on the original approval.