Vendor management programs can satisfy every regulatory requirement and still fail to tell leadership anything useful about whether a vendor can carry the initiative the CU has staked its next three years on.