A department manager calls you and asks for your help designing a formal policy:

"It's for hiring vendors. We don't have a formalized process for selecting and onboarding a new vendor. I want to make sure we know which stakeholders should be involved, what their roles are, and what steps need to happen in what order.

As an example, we need to hire a new vendor to generate invoices for our clients. The stakeholders here are the specific internal group that will deal with the new vendor (the finance team), the internal legal group, and management.

Since we're a privacy law consulting firm it's especially important that we conduct due diligence on the service provider to make sure they have good privacy practices. Internal Legal can handle that.

Finance will need to evaluate the vendors. Maybe they can generate a short list first.

We'll also need to negotiate two contracts with whichever vendor we pick: first, a services agreement that lays out the terms of the engagement - the fee, what happens if one of us screws up, etc. Second, we really need to sign a Data Protection Addendum with the vendor. That will ensure they're obligated to follow good privacy practices and, of course, that contract addendum is required by several privacy laws. Internal legal can also handle those contract negotiations and reviews, but we'll need to make sure management has final say on the wording of those contracts before they are signed.

Finance will probably be doing most of the communicating with the vendor about what the vendor is actually capable of doing and when they can start, but internal legal can handle all the contract negotiations, subject of course to management approval."

Please write step by step outline of a policy that describes the process for hiring a new vendor.