The Vendor AOC That Answered the Wrong Question

Cold open

The vendor sent the AOC in eleven minutes. The team spent the next eleven weeks trying to make it answer a responsibility question it had never been designed to answer.

The scene

The service provider was responsive, established, and central to the payment flow. Procurement had the contract. Security had the due-diligence packet. Compliance had a current attestation. The architecture diagram showed a neat cloud around the provider with one arrow entering and another leaving. Whenever responsibility came up, somebody pointed to the cloud and said the vendor handles that.

The sentence compressed several different ideas. The provider operated a service. The customer configured part of that service. An internal team decided which events entered it. Another team reviewed alerts. A separate group retained evidence. The AOC described the provider’s assessed services and conclusions. It did not assign the customer’s configuration, monitoring, escalation, or evidence duties for this particular implementation.

Narrative turn / 01

The request that bounced

A reviewer requested evidence for a monitoring activity. The internal owner sent the provider AOC. The reviewer asked where the customer responsibility was described. Compliance sent the contract. The contract named the service but not the operating control. Procurement sent the security exhibit. The exhibit promised capabilities but did not show who configured or reviewed them.

The request bounced among four teams because every document was real and none was the missing artifact. Each handoff widened Ownership Fog. People could identify who purchased the service, who administered it, who met with the vendor, and who received the bill. Nobody could point to one requirement-level or activity-level map showing the provider side, customer side, shared steps, and evidence source.

Narrative turn / 02

The N/A shortcut

Under deadline pressure, someone proposed marking the activity not applicable internally because the provider performed it. That conclusion felt efficient, but it repeated the original mistake. The question was not whether the provider did something related. The question was which exact activity the implementation required from each party and what facts supported that division.

The team opened the service documentation, contract, AOC, configuration screens, runbook, and alert queue together. The documents stopped competing once each was allowed to answer its own question. The AOC supported what had been assessed about the provider. The configuration showed what the customer enabled. The runbook showed who reviewed events. The queue showed how exceptions moved.

Narrative turn / 03

Turning the cloud into a seam

Instead of drawing one cloud labeled vendor, the team drew a seam. On the left: provider-operated platform activities and provider evidence. On the right: customer configuration, data selection, review, escalation, and retention. In the center: shared activities that failed if either side assumed the other had completed the handoff.

The responsibility map fit on two pages. It was less impressive than the AOC and more useful in the next meeting. Every row named the service activity, provider role, customer role, internal owner, evidence, and trigger for reassessment. The AOC remained important. It simply stopped being forced to impersonate a responsibility matrix.

What changed

The evidence request closed after the internal team produced its configuration, review record, and escalation trail alongside the provider material. No heroic new control was invented. The team simply stopped asking one document to prove both sides of a relationship.

At the next vendor review, the first agenda item was no longer please send the latest AOC. It was show us what changed in the service, the responsibility seam, and the evidence path. The cloud on the diagram remained. Now it had edges, owners, and a door.