vendor employee

A category of human workforce member recognized in governance, risk, and compliance frameworks — specifically, an individual who is employed by an external vendor organization but whose work, access, or conduct is relevant to the engaging entity's control environment. Distinguished from direct employees and independent contractors, vendor employees are natural persons on another organization's payroll who nonetheless touch the engaging entity's systems, data, processes, or physical premises; the engaging entity does not control the employment relationship but is responsible for extending its security, ethics, and competency standards to cover them. In practice, frameworks such as the AICPA SOC 2 Trust Services Criteria treat vendor employees alongside contractors as a third class of in-scope workforce — persons who must be vetted for background and technical competency, trained on applicable standards, and held to codes of conduct — precisely because their employment by a separate legal entity does not relieve the engaging entity of responsibility for the risks they introduce.