UpGuard Vendors exports need a reproducible field contract
UpGuard documents an Excel export that includes the optional columns currently shown on the Vendors page. That file can serve as a point-in-time operating artifact only when its view, filters, columns, meanings, row population, permissions, extraction time, and integrity remain reproducible.
Third Party Current editorial graphic. Source material: UpGuard Vendors section documentation; analysis and presentation by Third Party Current.
Treat the export definition as part of the artifact
The direct answer is that an exported workbook needs a field contract, not just a download time. Preserve the tenant or portfolio, saved-view identifier and version, filters, sort, search terms, visible columns, column order, page or population scope, exporter identity and role, permission set, requested format, extraction start and completion time, time zone, file name, row count, and cryptographic hash. If the export includes only the optional columns shown in the current view, that selection is material evidence about what the file does and does not contain.
A field contract should define each header, stable field identifier, data type, allowed values, units, null meaning, display transformation, join key, source, freshness basis, and whether the value is observed, imported, calculated, assigned, or user-authored. A label such as vendor, rating, tier, owner, custom attribute, or questionnaire status can look self-explanatory while carrying tenant-specific configuration. Store the definition used for the file so a later UI or schema change cannot silently reinterpret an old column.
Freeze the row population and identity joins
Every row should retain a stable vendor identifier and the legal entity, service, subsidiary, or relationship scope it represents. Names and domains are useful display values but weak join keys: companies rename, domains redirect, subsidiaries share brands, and one provider can support several services. Reconcile the exported identifiers to the governed vendor and contract inventory, record unmatched and duplicate rows, and preserve exclusions rather than assuming the visible table is the whole third-party population.
Filters are also evidence. A view limited by tier, label, owner, status, business unit, or search term should not be circulated as an enterprise register without that boundary. Empty cells must remain distinguishable from not applicable, not collected, unavailable, filtered, redacted, or failed to export. If a spreadsheet process adds formulas, mappings, notes, or deletions, retain the untouched export and log the transformation separately.
Separate snapshot evidence from live and historical state
An Excel file shows what the selected view returned at an extraction time; it does not prove what the platform shows now or what governed a former decision. Preserve the source file, field contract, export event, and later imports as an immutable snapshot. Link changed rows to new snapshots rather than overwriting the earlier file, and keep correction records when an export is incomplete or a field definition was misunderstood.
Downstream reports should state their source snapshot, transformations, refresh cutoff, excluded records, and owner. A current export should not be used to reconstruct a past approval if ratings, labels, custom attributes, questionnaire status, portfolio membership, or vendor identity have since changed. This decision object is the exported data artifact and its reproducibility; it does not repeat the separate question of how a vendor tier rubric is designed or whether any risk is accepted.
Test a saved view through schema and permission changes
A representative evaluation should create vendors with similar names, two services for one provider, custom attributes, blank values, labels, and different user permissions. Save a filtered view, reorder optional columns, export it, change one field definition, alter a user's access, remove a vendor from the visible portfolio, and export again. Reviewers should reproduce both row populations and every column meaning, detect the schema and permission changes, and reconcile the files without treating absence as a clean result.
UpGuard's help page supports the attributed documentation about the Vendors section, table customization, saved views, optional columns, and PDF and Excel exports. It does not establish a customer's field definitions, portfolio completeness, identity mapping, permissions, export behavior, file integrity, data accuracy, risk classification, assessment, acceptance, remediation, or outcome. Accountable risk, procurement, security, data-governance, privacy, compliance, and legal owners retain those judgments.
What we will watch next
Third Party Current will watch for later primary-source evidence that changes the maintained company, capability, or standards record. The next useful evidence may include implementation documentation, release details, regulator findings, corrected methods, product packaging, customer-observable workflow, or a subsequent company statement. Until then, the dated source and its stated boundary remain attached to this analysis.
