Supervisors reviewing fintech outsourcing want to see materiality judgments, not an inventory of every stationery supplier. A register that lists fifty vendors with identical risk scores invites more questions than a shorter list with reasoned tiers.
For each material vendor, record the service description, data or funds touched, exit plan summary, last assurance date, and the internal owner. Those five fields cover most interview questions.
Incident history belongs in a linked log, not as a free-text paragraph inside the register. Separate structures keep board extracts readable.
Update the register when contracts renew or scopes expand. Stale entries — especially those still describing a vendor you no longer use — undermine confidence in the rest of the file.
When Stonegate reviews vendor controls, we test whether the register matches contracts and whether oversight meetings actually occurred. A tidy spreadsheet that never drove a meeting still leaves a finding.