The vendor risk playbook for shared-resource programs.
A step-by-step approach for finding and de-risking vendor over-commitment across concurrent projects — before it shows up as a schedule surprise on any one of them.
PulsePMO IQ · Playbook for PMO and portfolio leaders
The same vendor or systems integrator is frequently booked across several concurrent projects, each of which looks adequately resourced when reviewed on its own. The risk that actually matters — a vendor committed at 130–150% of stated capacity across projects that don't otherwise share a reporting line — is invisible at the project level by construction, and only becomes visible once someone deliberately rolls up commitments across the whole portfolio. This playbook is that process.
Step 1: Build the vendor commitment inventory
List every vendor with an active commitment on any current project
— not just the largest contracts. Under-the-radar vendors are the ones most likely to be double-booked, precisely because nobody is watching them closely.
Record commitment in the unit that actually constrains capacity
— hours per week, named individuals, or a percentage of the vendor's stated capacity — not just dollar value, which hides overcommitment on fixed-fee arrangements.
Pull this from contracts and current statements of work, not from project plans.
Project plans reflect what was requested; contracts reflect what the vendor actually agreed to deliver, which is frequently smaller.
Step 2: Compute true utilization per vendor
For each vendor, sum their committed capacity across every active project and compare it to their stated total capacity. Do this even for vendors that look fine on any single project — the overcommitment only appears in the sum.
| Utilization | What it means |
|---|---|
| Under 70% | Healthy headroom; low priority for review |
| 70–85% | Watch — flag for review before adding any new commitment |
| 85–100% | At capacity — new commitments should be declined or delayed pending review |
| Over 100% | Active overcommitment — requires immediate triage, not just monitoring |
Step 3: Triage anything over 85%
Confirm the number with the vendor directly.
Internal records of committed capacity and the vendor's own view of it frequently disagree — resolve this before deciding anything.
Identify which projects are most exposed if the vendor slips.
Not every project affected by an overcommitted vendor carries the same consequence — rank by schedule sensitivity and cost of delay.
Decide deliberately, don't let it resolve itself by whichever project escalates first.
The project that shouts loudest is not necessarily the one that should get priority — that should be a portfolio-level call, not whoever's project manager is most persistent.
Discovering the overcommitment only after one project has already escalated a schedule risk — at which point the fix is reactive and usually more expensive than it would have been three weeks earlier, when the second project's commitment was first added.
Step 4: Build the escalation path before you need it again
Set a utilization threshold that triggers automatic review
— 85% is a reasonable default — rather than relying on someone remembering to check.
Require a portfolio-level check before adding new commitment to any vendor already above the watch threshold.
This is the single highest-leverage control — it prevents the next overcommitment rather than just catching the current one.
Assign ownership of the check to the PMO, not to individual project owners.
Project owners are structurally positioned to see only their own project's slice of a vendor's commitment.
Step 5: Make it continuous
A one-time vendor audit finds the overcommitments that exist today. It does not catch the one that gets created next quarter when a new project signs the same vendor without checking. The inventory in Step 1 needs to be a living view, updated as commitments change, not a periodic exercise — otherwise the same risk resurfaces on the same cycle the original audit was meant to close.
Procurement linked to project work, in one portfolio-level view — in the product tour.
This playbook reflects general vendor-risk practice patterns and is not specific to any named customer or engagement.