A comprehensive transformation initiative to revolutionize vendor and supply chain risk management through AI-powered orchestration, reducing cycle times from 30+ days to same-day processing while ensuring 100% audit coverage and risk-aligned contract terms.
NiSource's current vendor management ecosystem operates across fragmented systems—ServiceNow for intake, TPRM/Fortress for assessments, Archer for GRC, and disparate CLM tools for contracts. This analysis, derived from L5 process mapping sessions, whiteboard reviews, and stakeholder interviews, reveals 47 distinct process activities across 10 major workflow stages, with significant manual rework, unclear accountability, and no unified view of vendor risk posture.
Our analysis identified fundamental disconnects across the vendor lifecycle, with each stage operating in isolation and requiring manual handoffs that introduce delays, errors, and compliance gaps.
| Metric | Current Performance | Industry Benchmark | Gap |
|---|---|---|---|
| End-to-end cycle time | 21-30 days | 5-7 days | -76% |
| Manual touch points | 15+ interactions | 3-5 interactions | -70% |
| First-pass accuracy | 60% | 95% | -35% |
| Risk coverage in contracts | 30% | 90% | -60% |
| Evidence re-use rate | 0% | 80% | -80% |
Our transformation employs a sophisticated 3-agent pattern that revolutionizes each process stage through intelligent orchestration, domain expertise, and continuous monitoring.
The intake transformation leverages vendor knowledge bases and inference engines to reduce a 25-question form to 3-5 targeted questions, while improving data quality and risk assessment accuracy.
Automated evidence collection, parallel assessment tracks, and intelligent normalization eliminate manual re-work and reduce assessment cycles from 10-20 days to same-day completion.
Every identified risk automatically generates appropriate contract clauses, ensuring 95% coverage of remediation requirements in legal terms.
Proactive surveillance of vendor changes, contract renewals, and risk indicators with automated response workflows.
| Event Type | Detection Method | Automated Response | SLA |
|---|---|---|---|
| Contract Renewal | 90-day advance alert | Trigger reassessment, pull latest risks | Same day |
| Security Incident | Threat intel feeds | Immediate risk recalc, contract review | 2 hours |
| Scope Change | Amendment detection | Re-assess new services, update controls | 24 hours |
| Evidence Expiry | Document tracking | Request refresh, notify stakeholders | 5 days |
| M&A Activity | Vendor monitoring | Full reassessment, contract review | 48 hours |
| Process Area | Current State | Agentic Future State | Improvement |
|---|---|---|---|
| Intake |
• 25+ questions • 45 min completion • Manual review • Inconsistent data |
• 3-5 smart questions • 5 min completion • AI enrichment • 95% accuracy |
89% reduction |
| Risk Assessment |
• 5-10 day delay • Manual scoring • Email-based • No standards |
• Real-time scoring • AI-calculated • API-integrated • Standardized |
100% automated |
| VCA Process |
• 10-20 days • Manual evidence • Re-keying data • Lost artifacts |
• Same-day • Auto-collection • Direct integration • Central repository |
95% faster |
| Remediation |
• Email tracking • 2-3 day notification • No SLA enforcement • Manual follow-up |
• System tracking • Instant notification • Auto-escalation • AI follow-up |
Real-time |
| Contract |
• 21-30 days • Risk disconnect • Email redlines • Manual process |
• 5-7 days • Risk-aligned • CLM integrated • AI-generated |
76% faster |
The implementation leverages Camunda 8 as the central orchestration engine, with OpenAI agents providing intelligence via Model Context Protocol (MCP), all integrated with existing enterprise systems.
Every agent action and system event flows to Databricks for real-time analytics, audit trails, and operational intelligence.
| System | Integration Type | Direction | Frequency | Data Elements |
|---|---|---|---|---|
| ServiceNow | REST API / Webhook | Bi-directional | Real-time | Intake data, status updates |
| TPRM/Fortress | REST API | Bi-directional | Event-driven | Assessment creation, findings |
| Archer/GRC | SOAP/REST API | Write | On completion | Remediation items, risk scores |
| CLM Systems | REST API | Bi-directional | Event-driven | Contract drafts, approvals |
| Databricks | Streaming API | Write | Continuous | All events, metrics, audit |
| Email/Teams | Graph API | Write | As needed | Notifications, escalations |
A 12-week transformation journey designed to deliver quick wins while building toward comprehensive agentic orchestration. Each phase builds on the previous, with continuous value delivery and minimal disruption to ongoing operations.
| Risk | Likelihood | Impact | Mitigation |
|---|---|---|---|
| API integration complexity | Medium | High | Start with ServiceNow (best documented), use proven connectors |
| Agent accuracy concerns | Low | High | Human-in-loop for high-risk, confidence scoring, gradual rollout |
| Change resistance | High | Medium | Quick wins focus, clear communication, training programs |
| Data quality issues | Medium | Medium | Data cleansing sprint, validation rules, exception handling |
| Compliance concerns | Low | High | Full audit trail, human gates for critical, regulatory review |
| Stakeholder Group | Current Pain | Value Message | Engagement Strategy |
|---|---|---|---|
| Business Users | Long forms, delays | "5-minute intakes" | Pilot program, champions |
| SCRM Team | Manual work, rework | "Focus on exceptions" | Co-design sessions, training |
| Legal/Procurement | Risk gaps, slow contracts | "95% risk coverage" | Review gates, control maintained |
| IT/Security | Integration complexity | "Modern architecture" | Technical workshops, documentation |
| Leadership | Audit findings, cost | "$2M savings, full compliance" | Dashboard access, regular updates |
Based on analysis of 47 process activities, 500+ annual vendor engagements, and 8-10 FTE current allocation, the transformation delivers measurable value across efficiency, risk, and compliance dimensions.
| Intake time reduction | 89% (45 min → 5 min) |
| Assessment cycle time | 95% (15 days → same day) |
| Contract generation | 76% (25 days → 6 days) |
| Manual touchpoints | 80% (15 → 3) |
| FTE reallocation | 6.5 FTE to strategic work |
| Risk coverage in contracts | 95% (from 30%) |
| Audit trail completeness | 100% (from 40%) |
| SLA compliance | 98% (from 60%) |
| Evidence reuse rate | 80% (from 0%) |
| Finding closure time | 75% faster |
| Category | Year 1 | Year 2 | Year 3 | 3-Year Total |
|---|---|---|---|---|
| Benefits | ||||
| Labor savings (6.5 FTE @ $85k) | $552,500 | $552,500 | $552,500 | $1,657,500 |
| Risk reduction value | $300,000 | $450,000 | $500,000 | $1,250,000 |
| Compliance penalty avoidance | $200,000 | $200,000 | $200,000 | $600,000 |
| Faster vendor onboarding value | $150,000 | $225,000 | $300,000 | $675,000 |
| Total Benefits | $1,202,500 | $1,427,500 | $1,552,500 | $4,182,500 |
| Costs | ||||
| Implementation (one-time) | $450,000 | - | - | $450,000 |
| Camunda 8 licensing | $75,000 | $75,000 | $75,000 | $225,000 |
| OpenAI API costs | $36,000 | $48,000 | $60,000 | $144,000 |
| Databricks platform | $60,000 | $60,000 | $60,000 | $180,000 |
| Support & maintenance | $50,000 | $75,000 | $75,000 | $200,000 |
| Total Costs | $671,000 | $258,000 | $270,000 | $1,199,000 |
| Net Benefit | $531,500 | $1,169,500 | $1,282,500 | $2,983,500 |
| ROI | 79% | 453% | 475% | 249% |
Reduced 25-question forms to 3-5 smart questions through AI inference, cutting intake time by 89% while improving data quality. Business users love the simplicity, SCRM gets better data.
Every identified risk now automatically generates appropriate contract clauses. 95% coverage of remediation requirements in legal terms, up from 30%. Audit findings resolved.
Eliminated manual chasing, follow-ups, and re-keying. 6.5 FTEs now focused on strategic vendor relationships instead of administrative tasks. 80% reduction in manual touchpoints.
100% audit trail coverage with every decision logged to Databricks. Real-time dashboards show vendor status, SLA compliance, and risk posture. Complete regulatory defensibility.
This transformation positions NiSource as a leader in utility sector vendor risk management: