A vendor questionnaire is complete except for one unanswered question about a subcontractor’s access to client files. The law firm is ready to start using the service. Who can decide whether that gap is acceptable? Vendor due diligence needs a named reviewer who can make that call. The banking case below offers a specific lesson about acting on information; the firm’s own legal and security reviewers determine what applies to its vendors.
The Public Case: An Alert Without Timely Follow Through
OFAC’s October 13, 2026 Bank of America settlement announcement describes apparent violations involving, among other issues, delayed watchlist updates and failures to prioritize certain alerts. The case illustrates an administrative lesson: collecting information and generating an alert are different from ensuring that the right person acts on it.
Where That Process Lesson Fits a Law Firm
For an e-discovery, cloud storage, transcription, or other provider, ask the firm’s responsible lawyers and security or compliance owners to define the review criteria. A vendor receiving sensitive client files may need different evidence from an office supplier. Use the approved channel and collect only the information needed for the defined review.
Record which request a document answers and the period it covers. If a certificate is expired or a questionnaire conflicts with a contract, route the discrepancy to the designated reviewer. Do not resolve a potential screening match or legal concern by guessing from a similar name.
Apply It to a Change in a Provider’s Service
Worked example: a U.S. law firm learns that a document-processing provider plans to use a different subcontractor. The coordinator records the proposed change and asks the supervising lawyer and security reviewer which evidence they need. The provider’s returned questionnaire is linked to the request, but an unanswered question about where files will be handled remains open. The authorized reviewer determines whether and on what conditions the firm may proceed.
Carry the Decision Into Ongoing Administration
Keep the review decision with the information the firm considered and any conditions it imposed. If a provider changes its subcontractor, service, or data-handling arrangements, route that change to the responsible reviewer under the firm’s process. An old approval should not silently cover a materially different service.
Track evidence dates separately from the date of the relationship review. A certificate can expire soon after the review closes. Assign the request for replacement evidence and give the reviewer a way to see unresolved conditions before more work is sent to the provider. The coordinator maintains this record; authorized reviewers decide whether the firm may proceed.