Vendor Management for Property Managers

Not every vendor deserves the same scrutiny. The company that repaints the lobby once a year and the company that holds keys to every unit are not the same risk. Treating them alike wastes your time on one and under-protects you on the other.

Sort your vendor list into tiers based on two questions: how much access does the vendor have, and how much damage would a failure cause?

Tier 1: Critical and high-access. These vendors hold keys, system credentials, or resident data, or they carry life-safety responsibility. Examples include elevator, fire and life safety, security, access control, payment processors, software providers that hold resident data, and anyone with master-key access. A failure here is a safety, legal, or financial emergency, so these vendors get the deepest vetting and the closest review.

Tier 2: Operational and recurring. These vendors keep the community running day to day without holding the highest-risk access. Examples include lawn care, janitorial, pool service, pest control, HVAC maintenance, and waste hauling. A lapse is disruptive and visible to residents but rarely catastrophic. These vendors get standard vetting and an annual review.

Tier 3: Transactional and low-access. This is one-off or low-stakes work, such as painting a single hallway, a one-time appliance delivery, or a seasonal decorator. Verify insurance, confirm the scope, pay, and move on.

Two tags override the tier, because they change how you handle a vendor whatever tier it sits in.

• Sole-source: Only one realistic provider exists, such as the original equipment manufacturer (OEM) for a proprietary elevator system. You cannot switch easily, so these vendors need a contingency plan.
• Data or system access: The vendor touches resident information or your platform logins. In Prevalent's 2024 Third-Party Risk Management Study, 61% of companies reported a third-party data breach or cybersecurity incident in the past year. A vendor with portal access is your risk, not only theirs.

Build the list once, tag every vendor, and revisit it whenever you add or drop one.

Find out a vendor is uninsured, unlicensed, or unreliable before they are on your property, not after a claim. Run every Tier 1 and Tier 2 vendor through the checklist below before you sign. Tier 3 vendors get the short version: insurance and the contract itself.

Insurance and legal terms vary by state and by property, so check each requirement with your attorney and your insurance advisor.

Insurance and liability

• A certificate of insurance (COI) on file that names the association or ownership entity the way your attorney and insurance advisor direct, not only a copy in a folder
• General liability limits that match the work, since a roofer needs more coverage than a window washer
• Workers' compensation coverage for everyone who will be on site
• Auto liability if the vendor drives on the property
• Expiration dates logged, with a renewal reminder set. A COI tracked only in a spreadsheet or an inbox is how a lapsed policy slips through until a claim exposes it

Licensing and credentials

• A state or local license for any trade that requires one, such as electrical, plumbing, HVAC, elevator, or pest control
• Manufacturer certification for warrantied or proprietary equipment
• Background-check confirmation for anyone with unit or key access

Track record

• Three references from properties similar to yours in size and type
• Online reviews, plus any litigation or lien history
• Years in business and financial stability, for any vendor you will depend on long term

The contract itself

• A defined scope of work, so "we thought that was included" never happens
• Clear pricing, escalation terms, and what triggers a change order
• Response-time and service-level commitments for anything urgent
• A termination clause with a notice period you can live with
• Indemnification and hold-harmless language reviewed by your attorney, especially for Tier 1 vendors

A vendor who will not provide a COI or references has removed themselves from consideration.

Vendors do not fail on a schedule, but a quarterly review catches most problems while they are still cheap to fix. Ninety minutes a quarter costs far less than a year of cleanup. Run the review the same way every time: pull your vendor list, sort it by tier, and work the agenda from top to bottom.

The quarterly review agenda

• Performance. Did each vendor meet scope and service levels? Note misses with specifics.
• Insurance and compliance. Are any COIs expired or set to expire within the next 90 days? Are any licenses lapsed? Follow up before either becomes a problem.
• Spend versus contract. Do invoices match the agreed pricing and scope? Are there unexplained increases or scope creep?
• Resident impact. Are any complaints, safety issues, or service gaps tied to this vendor?
• Open issues. What is unresolved from last quarter, and is the vendor on track to close it?
• Risk changes. Is any vendor newly handling data, keys, or critical systems and due to move up a tier?
• Renewals and bids. What comes up for renewal in the next two quarters? Is it time to re-bid a Tier 1 contract?

Score every vendor the same way

Ratings drift when they live in your head. A simple scorecard asks the same questions about every vendor and turns a gut feeling into a number you can track from quarter to quarter. Copy this table into your review and fill in a score for each line.

Score each line from 1 to 5, where 1 means replace and 5 means keep and expand. The total is out of 30 points. A score of 24 or more means renew with confidence. A score from 15 to 23 means put the vendor on a documented corrective plan with a recheck date. A score below 15 means start the offboarding process in the next section.

Document what you find

A review nobody wrote down did not happen. For each vendor, record the date, who reviewed, the score, and any action items with owners and due dates. That record gives you a clear history if a vendor relationship ever ends in a dispute, and it gives the next manager something to work from when they inherit the portfolio. Ask your attorney how long to keep these records.

Act on the pattern

One missed visit is a conversation. Three quarters of misses is a decision. The review exists so you see the pattern before it becomes a crisis, and so a vendor on probation knows exactly what to fix.

Ending a vendor relationship is where communities get hurt, because the damage happens in the gap. Keys do not come back. The old lawn care vendor's logins still work. Nobody tells the new company where the irrigation shutoff is. Offboarding is a process, not an email.

Whether a vendor is leaving on good terms or being let go, follow the same sequence: notify, transition, secure, and close out. The two scripts below cover the conversation, and the checklist covers everything after it.

Script: ending on good terms (non-renewal)

Hi [Name], I wanted to tell you directly rather than have you hear it through a renewal notice. We have decided not to renew the [service] contract when it ends on [date]. This is not a performance issue. We are making a broader change in how we handle [category]. I appreciate the work your team has done, and I want the handoff to go smoothly. Can we set up 15 minutes this week to walk through the return of keys and access, any open work orders, and final invoicing? I am happy to be a reference for you as well.

Script: ending for cause (performance)

Hi [Name], I am following up on the issues we have documented over the last few months: [specifics, with dates]. We talked through these in [month], and the pattern has not changed. We are ending the [service] agreement effective [date], consistent with the termination terms in our contract. I would like to handle this professionally on both sides. Please confirm the return of all keys, fobs, and system access by [date], and send a final invoice for completed work through [date]. Let me know if you have questions about the timeline.

Before you send either script, check the notice period and termination terms in your contract, and ask your attorney about any for-cause termination.

The offboarding checklist

• Written notice that matches your contract's termination clause and notice period
• All physical keys, fobs, and access cards returned and counted against what was issued
• Digital access revoked, including portal logins, building system credentials, gate and intercom codes, and email aliases
• Open work orders reassigned or closed, with nothing left unresolved
• Final invoice received, reconciled against the contract, and approved
• Records archived, including the contract, COIs, performance history, and the reason for the change
• Resident communication, if the change is visible, such as a new lawn care company starting Monday
• Successor vendor briefed on site specifics, including shutoffs, access points, quirks, and history

The offboarding checklist is also a security checklist. A former vendor with live credentials is an exposure that stays hidden until it becomes a problem.

The same failures show up across portfolios that look nothing alike. Knowing them in advance saves you from learning them the hard way.

Auto-renewing without review. Evergreen contracts roll over while pricing drifts up and service slips down. Track every renewal date and treat each one as a chance to reassess the relationship.

Letting COIs lapse. If an uninsured vendor is injured or causes damage on your property, you may be exposed. Track expirations and confirm renewals before the gap, not after, and ask your attorney and your insurance advisor what your exposure looks like.

Relying on one person's relationship. When a handshake with a departing manager is the only thing holding a vendor accountable, the next manager inherits a black box. Document the relationship, not just the contract.

Confusing cheap with good value. The low bid that cuts corners costs more in callbacks, complaints, and early replacement. Price matters, and so do reliability and coverage.

Keeping no paper trail on performance. If a vendor disputes a termination, a documented history is the first thing you will need. Write down the misses as they happen.

Skipping the handoff. Ending a vendor without a clean offboarding leaves keys out, logins live, and the new vendor working blind.

Categorization, COI tracking, quarterly reviews, and clean offboarding are all harder when they live in spreadsheets, inboxes, and one person's memory. The work is not complicated, but keeping it consistent across dozens of vendors and several buildings is. A purpose-built property management platform puts it in one place. In BuildingLink, that looks like this:

• Vendors directory. Staff keep contact details, notes, and an induction date for each outside vendor, and can email a vendor from the directory. The directory is internal only, so residents do not see it. Management companies can also add vendors that are common to every building in their portfolio.
• Vendor compliance tracking. For each vendor, you choose the documents required for compliance, such as a license, a workers' compensation COI, or a liability COI, and upload each document with its expiration date. A compliance column shows whether each vendor is compliant, expiring within 30 days, or expired, and a vendor insurance compliance summary sits at the top of the directory. Staff can also set up email notifications for expiring documents.
• Vendor work orders. Staff can assign a maintenance request to a vendor, generate a vendor work order from the request, and email it to the vendor. The completed work order can be stored with the request, so maintenance history stays documented and searchable.
• Document library. The document library organizes building documents with role-based permissions.
• Visitor and contractor tracking. Staff can log contractors as they arrive and leave. The event log keeps a permanent history of each visit, which you can check against invoices.
• Key management. KeyLink, an add-on to BuildingLink, tracks key sign-outs and returns, so you can confirm who holds a key. That helps when you count keys back at offboarding.
• Announcements. Staff can post an announcement to residents when a vendor change is visible, such as a new lawn care company starting Monday.

BuildingLink was built for this kind of operational work across condos, co-ops, HOAs, and multifamily properties. Vendor and contractor records, work orders, documents, and resident announcements sit in one platform, so vendor management becomes a process your whole team can run, and the next manager inherits the full history.

Vendor management comes down to consistency. Know which vendors carry the most risk, vet before you sign, review on a schedule, and offboard cleanly. None of it requires a procurement degree. It requires a system you run every quarter.

Your vendors are an extension of your community's reputation. When the elevator works, the grounds look sharp, and the insurance is current, residents credit the community. When a vendor fails, residents look to the manager. The four steps in this playbook are how you earn the credit and avoid the blame.