The business owner who wants the vendor should sign off on the risk, because they own the outcome. Security advises on the technical findings, legal covers contract terms, privacy reviews data handling and finance tracks spend. For critical vendors, add a senior approver.
A role split that works
| Role | Responsibility | Does not own |
|---|---|---|
| Business owner | States the need, accepts residual risk, owns the relationship | Technical assessment |
| Security | Reviews evidence, rates gaps, recommends conditions | The business decision |
| Legal | Contract terms, liability, breach notice, audit and exit clauses | Technical findings |
| Privacy | Data types, transfers, subprocessors, retention | Security controls |
| Finance or procurement | Registers the vendor, tracks renewals and spend | Risk acceptance |
| Executive sponsor | Approves critical vendors and exceptions | Day to day review |
The handoffs
- Request. The business owner submits a short form: purpose, data, access, expected spend and date needed.
- Triage. Security tiers the request and sends the evidence ask.
- Review. Security and privacy read the evidence in parallel while legal reads the terms.
- Recommendation. Security writes one page: findings, conditions, residual risk.
- Decision. The business owner accepts or declines. High tiers go to the executive sponsor.
- Record. Procurement registers the vendor with the decision, conditions and review date.
Keep each step's owner and target time visible so requests do not stall.
Why the business should accept the risk
When security owns the decision, the business treats it as a gate to get past. When the business owner signs, they have to read the gaps and weigh them against the benefit. It also reflects reality: if the vendor fails, the business process suffers.
Security should still have a way to escalate. If a business owner wants to accept a risk that security believes is unacceptable, the question goes up one level, with both views written down.
Small companies
In a small company one person may fill several roles. That is fine, but write the decision down anyway, and where you can, have someone other than the requester check the work. See who owns SaaS security in a small company.
Common mistakes
- Sign off with no named person, only a team mailbox
- Risk accepted with no expiry date
- Legal and security reviewing in sequence, which doubles the wait
- No path for urgent requests, which pushes people to buy without review
See who owns security questionnaires for the related handoffs on the answering side.
Quick check
Can security alone approve a vendor?
It can for low tier vendors under a clear policy. For vendors that hold sensitive data or have access, a business owner should accept the residual risk.
What if the business and security disagree?
Escalate to the executive sponsor with both positions in writing, and record the outcome with a review date.
Safeguard's policies and compliance evidence automation can help record approvals and review dates, and a free scan is at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
