Published November 2, 2026
Question and scope
This protocol asks how vendor follow-up aging can be described from the operating record, using one defined population and one observation window. The the operations manager owns the decision.
Population and unit of analysis
The unit is one vendor follow-up, from opening event through recorded close. Keep linked revisions separate and record the source date and owner.
Definitions and measures
Define the opening event, closing event, pause rule, and missing-evidence rule before collecting vendor follow-up aging data. Report eligible count, sample, exceptions, and unresolved items.
Evidence standard
Record the source, observation time, field supported, reviewer, and decision owner. Keep restricted operational data in the approved system. Example: Age is a warning signal; the service impact, owner, and promised response determine urgency.
Sampling and collection
Sample routine, exception, and reopened records. Preserve the original observation when a definition changes and label the new rule for later cases.
Analysis and reporting
Report observation separately from interpretation. Show the oldest open item and missing fields, not only the completion rate. Name the next decision and its owner.
Limits and sources of error
The cited public sources frame operating records, privacy, security, and internal-control practice in general terms; they do not provide a local result or a management conclusion for a specific team.
Review cadence
Review the result on a fixed date and end with one process change, one owner, and one check date. A repeated defect should change the template before it changes coaching.
Sources
- U.S. Department of Labor — checked November 2, 2026.
- Federal Trade Commission — checked November 2, 2026.
- NIST Cybersecurity Framework — checked November 2, 2026.
- U.S. Small Business Administration — checked November 2, 2026.
- U.S. Government Accountability Office — checked November 2, 2026.
- CISA Secure Our World — checked November 2, 2026.
