Vendor Performance Review Template

Find the service level agreement (SLA) before you score anything, because it is what turns a complaint into a claim. It may sit in a numbered exhibit, a schedule or a separate web page, so search the contract for "service level", "uptime" and "service credit".

To see a real one, read Atlassian's published cloud SLA. It commits to 99.9% monthly uptime on Premium plans¹ and credits 10%, 25% or 50% of the monthly fee as uptime falls below 99.9%, 99% and 95%.

Write down only what your contract says. If it sets no target for lower-severity tickets, record that as a gap to raise at renewal, not a number to invent. A one-page contract summary helps pull these terms out of a long agreement.

When each month closes, collect the vendor's uptime report or status page history, your own monitoring records, and a support ticket export with timestamps. Add that month's invoice, since credits are a share of the fee.

Next, check whose numbers count. Atlassian's SLA makes its own monitoring and logging the sole source of truth¹. Amazon Web Services, by contrast, asks a customer claiming a credit for request logs that corroborate the outage², so your own records become the evidence. Where the vendor's figure decides, still compare it with yours and raise any gap at the review.

Convert percentages into time so everyone can picture them. In a 30-day month, 99.9% uptime allows about 43 minutes of downtime, and 99% allows about 7 hours.

For each month, record the measured value, the tier it lands in, the credit percentage and the dollar amount against that month's fee. Keep months with no breach on the sheet too. A scorecard of only bad months can't show a trend.

Carry the real number. A month at 99.88% rounds to 99.9%, but it still misses a 99.9% commitment, and rounding it up hides a credit you are owed.

Don't wait for credits to appear on an invoice. Each of the three published SLAs below makes the customer ask within a set window, and the windows differ.

Miss the window and the money is gone. Google's terms say a customer who doesn't notify it in time, with logs, will forfeit its right to receive a Financial Credit³. Track each priced breach as open, claimed or forfeited, and put its deadline on the calendar the day the month closes.

Once a claim is approved, check that the credit shows up on a later bill. All three SLAs apply credits against future charges, and none entitles you to a cash refund.

One breach earns a credit. A run of breaches is a different problem. A negotiated contract may give you more for it, such as the right to demand a corrective action plan after three breaches in 12 months.

In 2023 guidance to banks on third-party relationships, the Federal Reserve, FDIC and OCC say an effective contract defines default, identifies remedies and allows a chance to cure⁴. Such a contract also sets out when termination applies. Find each of those clauses in yours before you write to the vendor.

Answer a pattern that crosses your contract's threshold with an improvement request. Name each breach by month, measured value and tier. Ask for a root cause and a dated corrective action plan, not general reassurance. Then state what the contract provides if the plan slips, and nothing it doesn't.

Match the effort to how much you depend on the vendor. The same guidance says more comprehensive or frequent monitoring is appropriate⁴ when a vendor supports higher-risk activities. It also counts periodic meetings with the vendor to discuss performance among typical monitoring activities.

Send the agenda ahead with the numbers in it: SLA results, credits claimed and forfeited, the repeat-breach check, then the worst tickets. Let the vendor answer in writing. US federal agencies, for example, give contractors up to 14 calendar days to comment on or rebut⁵ a performance evaluation, and keep the reply with the record.

After the meeting, write a one-page memo: results against the contract, money priced, claimed and forfeited, decisions, owners and dates. Carry anything open, like a claim still inside its window, into the next agenda.

If the review turns up a security or data concern rather than a service one, run a vendor risk assessment alongside it. The template on this page sets up the scorecard, credit tracker, memo and improvement request, and River can build the scorecard from your own contract's SLA.