vendor responsibility