Vendorapp › OpenVMO › Metrics and reporting
Metrics and reporting in OpenVMO.
Metrics show whether the programme is working, and evidence shows auditors and customers that it is. This domain cuts across the other ten: a small set of measures, an honest yearly self-assessment against OpenVMO, and an evidence pack you can produce quickly.
Open standard, CC BY 4.0 · Free, no sign-up · Works with a spreadsheet · Maps to SOC 2, ISO 27001, NIS2, DORA
Why it matters
What this domain is for.
Leadership cannot oversee what it never sees, and auditors and enterprise customers ask for evidence on their timetable, not yours. Producing the pack in an hour rather than a week is the difference a programme makes.
Metrics and reporting is one of the 11 domains of the OpenVMO framework, an open standard for running vendor management at a startup. Each practice below has a minimum maturity level: you only need the practices at or below the level you are aiming for.
Practices
The 3 MET practices.
Leadership measures
A small set of measures is reported to leadership at least once a year: vendors with an owner and a tier, Tier 1 vendors with current assurance, renewals missed, overdue reviews, offboardings with confirmed deletion, vendor incidents, and time from request to approval. Evidence: The report or dashboard shared with leadership, with its date.
Yearly self-assessment
The programme is self-assessed against OpenVMO once a year and the result is shared internally. Evidence: The self-assessment, with the level claimed and evidence for each practice.
Evidence on demand
An evidence pack (register, policy, tiering, diligence, contracts, reviews, offboarding) can be produced on demand for auditors and customers. Evidence: A recent evidence pack and how long it took to produce.
A practice counts as in place only when a dated record shows it was performed. A tool that could perform it does not count on its own.
By stage
What good looks like at each level.
| Level | What good looks like |
|---|---|
| Level 1: Foundational | The register itself is your evidence. Keep it current. |
| Level 2: Managed | An evidence pack that can be assembled on request within a day. |
| Level 3: Defined | Measures reported to leadership and a yearly OpenVMO self-assessment. |
| Level 4: Optimised | Measures tracked continuously, with targets, and benchmarked year on year. |
With a spreadsheet
Doing it without any special tool.
- Use the OpenVMO measures sheet: each measure is a formula over the register.
- Keep an "evidence pack" folder with a copy of the policy, the register export and the latest reviews.
- Put the yearly self-assessment in the calendar next to the policy review.
Common mistakes
Where teams usually go wrong.
- Measuring the number of vendors assessed instead of whether the right ones were.
- Assembling evidence from scratch for every audit or customer review.
- Claiming a level without evidence for every practice it requires.
Crosswalk
How this maps to the frameworks you are audited against.
| Framework | Related requirements |
|---|---|
| SOC 2 (Trust Services Criteria) | CC4.1, CC4.2 |
| ISO/IEC 27001:2022 | Clauses 9.1, 9.3 |
| NIS2 and Implementing Regulation 2024/2690 | Art. 21(2)(f) |
| DORA | Art. 6(6); Art. 28(2) |
| NIST CSF 2.0 | GV.OV, GV.SC-09 |
The mapping is informative, not legal advice: it points to where each framework deals with the same topic. The full mapping for every practice is on the crosswalk page.
Templates
Templates for this domain.
- Measures sheet (CSV): The seven OpenVMO programme measures, with how to calculate each from the register.
All OpenVMO templates are on the templates page.
Previous domain: Offboarding and exit.
Run OpenVMO with a spreadsheet, or with a tool.
Every practice can be met with the free templates. If you would rather not maintain the register by hand, Vendorapp implements most of OpenVMO and has a free plan.