Find Resources & Connect with members on topics that interest you.

AI - Acquire and Implement

PO - Plan and Organize

DS - Deliver and Support

Please sign in to see your topics.

You must be logged in to join this group.

AI5.3 - Supplier Selection

This topic is intended to enable collaboration and sharing of information to facilitate a better understanding and approach to implementing this COBIT control objective based on the risk, value and guidance provided by its corresponding control practices.

COBIT Control Objective AI5.3 - Supplier Selection is contained within Process Popup Procure IT Resources.

Learn more about COBIT and related publications.

Click “Join This Community” to be able to actively participate in discussions and contribute content. You must be an ISACA member to join this topic. Join ISACA now.

 
This Topic Has:
3 Members
0 Online
2472 Visits

 Recent Discussions

Community Leader

Knowledge Center Manager

Knowledge Center Manager

Title: Become a Topic Leader!


Supplier Selection

Select suppliers according to a fair and formal practice to ensure a viable best fit based on specified requirements. Requirements should be optimised with input from potential suppliers.

View value and Risk Drivers  help

Hide value and Risk Drivers help


Value Drivers

  • Contribution to new ideas and practices
  • A continuous contribution to the organisation’s objectives beyond supplier SLAs
  Risk Drivers
  • Inappropriate supplier selection
  • Inadequate support for the achievement of the organisation’s objectives
  • Gaps between supplier requirements and capabilities

View Control Practices  help

Hide Control Practices  help

  1. Review all requests for information (RFIs) and requests for proposal (RFPs) to ensure that they:
    • Clearly define requirements
    • Include a procedure to clarify requirements
    • Allow vendors sufficient time to prepare their proposals
    • Clearly define award criteria and the decision process
  2. Evaluate RFIs and RFPs in accordance with the approved evaluation process/criteria, and maintain documentary evidence of the evaluations. Verify the references of candidate vendors.
  3. Select the supplier that best fits the RFP, document and communicate the decision, and sign the contract.
  4. In the specific case of software acquisition, include and enforce the rights and obligations of all parties in the contractual terms. These rights and obligations may include ownership and licencing of intellectual property, maintenance, warranties, arbitration procedures, upgrade terms, and fit for purpose, including security, escrow and access rights.
  5. In the specific case of acquisition of development resources, include and enforce the rights and obligations of all parties in the contractual terms. These rights and obligations may include ownership and licencing of intellectual property; fit for purpose, including development methodologies; languages; testing; quality management processes, including required performance criteria; performance reviews; basis for payment; warranties; arbitration procedures; human resource management; and compliance with the organisation’s policies. Obtain legal advice on resource development acquisition agreements regarding ownership and licencing of intellectual property.
  6. In the specific case of acquisition of infrastructure, facilities and related services, include and enforce the rights and obligations of all parties in the contractual terms. These rights and obligations may include service levels, maintenance procedures, access controls, security, performance review, basis for payment and arbitration procedures.

Discussions: 0 total

Must be a Topic member to contribute

No Results Found

Documents & Publications: 41 total

Must be a Topic member to contribute
View All »
Books
Posted by ISACA 132 days ago
Books
Posted by ISACA 138 days ago
Downloads
Posted by ISACA 237 days ago
Books
Posted by ISACA 278 days ago

Events & Online Learning: 1 total

14 Oct 2013
ISACA International Event
Boston, MA, USA

Journal Articles: 122 total

Volume 2, 2013
by Rajesh Bhatia, CISA, CGEIT, PMP, MDP
This article discusses the benefits of using the framework of the five IT governance focus areas.
Volume 4, 2012
by Danny M. Goldberg, CISA, CGEIT, CCSA, CIA, CPA
Internal audit (IA) departments should not lose sight of the importance of the ARA and its tangible and intangible benefits to the company and the department.
Volume 3, 2012
by Aarni Heiskanen, LJK
A program or project portfolio explains how an organization is implementing its strategy with projects.
Volume 1, 2012
by Prakhar Srivastava and Tarun Verma
Log management can play a pivotal role in addressing PCI DSS requirements, be a success factor and enabler for safeguarding cardholder transaction data, and provide a secure and vulnerability-free environment for cardholders.
Volume 6, 2011
by Harmeet Kaur, CEH
As today’s business climate demands greater efficiency, security and regulatory compliance, the need for an effective IAM process has never been more pressing.
Volume 5, 2011
by Derek Mohammed, Ph.D., CISA, CISSP, PMP
Organizations need fully articulated security policies and procedures based on industry best practices to solidify their information system defenses and meet legal, contractual and regulatory requirements.

Wikis: 2 total

Blog Posts: 8 total

DISCLAIMER :- Below information is just for knowledge sharing purpose and reference. Personally or on behalf of any organization; I do not recommend any specific / particular tool listed below. These are the ones which I have come across. there may be t...
Posted By : prathameshkarekar | 0 comments
www.itpp.info
Posted By : Alexei.Shindin | 0 comments
In our current challenging financial times, businesses globally are trying to get by doing more with less.  In the past few years since the onslaught of the recession in 2007, companies have slashed positions that were thought to not be essential to survi...
Posted By : Robert992 | 1 comments
On March 1st,  I was invited to speak at the CampIT conference on Enterprise Risk/Security Management at Rosemont Convention Center. Before me there were two speakers. The first presenter spent an hour presenting the story from the trenches of technolog...
Posted By : Umesh391 | 1 comments
17 Aug 2011
Posted By : masarker | 0 comments
These are five possible ways to discover Unstructured Processes. Regulatory and Compliance processes - People-intensive processes that are kicked off as a result of an external regulatory body and these processes tend to be ad-hoc & on-going change, but...
Posted By : Varun | 1 comments