FAQs
Have Questions?
Which vendors does the audit cover?
All IT-related vendors: software subscriptions, cloud services, managed services contracts, telecom and internet providers, hardware suppliers, security tools, backup and recovery services, and consulting engagements. The audit also covers the smaller vendors that ride on a personal card and get reimbursed back. The accounting system is the starting inventory, the IT environment is the second pass.
What does CinchOps look at on each vendor?
Five dimensions: performance against the contract SLAs and deliverables, contract terms (auto-renewal, termination notice, price increases), security posture (questionnaire, attestation, breach history), redundancy with other vendors doing similar work, and the dependency level the business has on that vendor. Each gets a score, and the scores roll up into the renewal recommendation.
How does the audit handle security questionnaires?
CinchOps maintains a standard vendor security questionnaire mapped to the common compliance frameworks and cyber insurance requirements. Vendors that touch firm data get the questionnaire, the responses are reviewed against the firm's risk standard, and gaps are flagged for renegotiation or replacement. The questionnaire becomes part of the procurement workflow going forward.
What if a vendor is critical and there is no alternative?
The audit notes the dependency, flags the lack of alternatives as a business continuity issue, and recommends compensating controls. Common compensating controls are stronger contract terms (notice periods, data portability, escrow), parallel relationships with similar vendors as a backup, and internal documentation of the workflow so a switch would be possible if the vendor failed.
How often should we re-audit?
Annually is the right cadence for the full audit. The renewal calendar runs continuously, so high-value contracts get a 90-day review before each auto-renewal date. New vendors get vetted at procurement time using the same scoring framework. Most CinchOps clients fold the vendor review into the same operating cadence as the IT cost assessment.