Research question
Which exceptions make vendor onboarding a recurring back-office workload?
What authoritative sources establish
The IRS explains that Form W-9 is used to provide a correct taxpayer identification number, and CISA's small-business guidance emphasizes managing third-party cyber risk. These are different controls, but both depend on complete, attributable vendor information before downstream work begins.
Operational analysis
Count submissions missing tax records, ownership, service scope, security review, or approved payment instructions. Track first-pass completion, exception age, resubmissions, and approval time rather than relying on vendor count alone.
Staffing boundary
Administrative staff can collect approved documents, apply completeness rules, and route exceptions. Tax classification, risk acceptance, vendor approval, and payment-control decisions need qualified owners.
Conclusion
Count submissions missing tax records, ownership, service scope, security review, or approved payment instructions. Track first-pass completion, exception age, resubmissions, and approval time rather than relying on vendor count alone. This evidence supports a capacity decision only when the queue recurs and a named owner reviews exceptions.