Third-Party and Vendor Risk Management That Scales
Questionnaires do not reduce risk. Tiering, contracts, and monitoring do.
Vendor risk management collapses under its own weight in most enterprises. The register lists 400 suppliers, the team can meaningfully assess perhaps 40, and the response is to send everyone a 300-question spreadsheet that nobody has capacity to review. Effort is high, risk reduction is low.
Scaling requires accepting that most vendors do not warrant deep assessment, and concentrating real scrutiny where failure would actually hurt.
Tier by consequence
| Tier | Criteria | Assurance depth |
|---|---|---|
| Critical | Production access, sensitive data at scale, or operations stop without them | Independent audit evidence, architecture review, annual reassessment, contractual controls, continuous monitoring |
| Important | Some personal or confidential data, replaceable in weeks | Audit report review, targeted questionnaire, biennial reassessment |
| Standard | No sensitive data access, easily replaced | Basic due diligence at onboarding only |
Tier on the actual data and access granted, not on contract value. A small analytics vendor with a script on your checkout page carries more risk than a large facilities supplier.
Seek evidence, not attestation
Self-completed questionnaires tell you what a vendor believes about itself. For critical suppliers ask instead for independent audit reports and read the exceptions section, penetration test summaries with remediation status, and evidence of specific controls that matter to your use — encryption, access management, backup and recovery testing, and secure development practice.
Reserve bespoke questions for genuine gaps. A short, specific set of questions receives better answers than a long generic one.
Put the controls in the contract
Assessment describes the current state; contract terms give you leverage when it changes. Insist on incident notification within a defined period, audit rights or audit report provision, sub-processor disclosure with approval for material changes, data location and deletion obligations, defined security commitments, and exit assistance including data return in a usable format.
Exit terms are consistently under-negotiated and consistently regretted. Negotiate them while you still have commercial leverage.
Monitor continuously, not annually
Annual reassessment misses everything that happens in between. Add lightweight continuous signals: breach and incident notifications for your vendor list, external security posture monitoring, certificate and domain hygiene, financial stability indicators for critical suppliers, and changes to their sub-processor lists.
Maintain an accurate register mapping each vendor to data classes, systems reachable, and business process supported. When the next widely exploited vendor vulnerability appears, that register decides whether triage takes hours or a fortnight.
Address concentration risk explicitly
Individual vendor assessment misses systemic exposure. Map where many critical vendors depend on the same cloud region, the same identity provider, or the same payment processor — a single outage upstream can take out several apparently independent suppliers at once.
For each critical concentration, document what the business does during an extended outage. That answer is more useful than any questionnaire response, and it is what regulators increasingly ask for.
Make it fast enough to be followed
A risk process that delays procurement by six weeks gets bypassed, and bypassed vendors are unassessed vendors. Publish tier criteria so requesters know what to expect, pre-approve common SaaS categories, use a lightweight intake that routes low-risk purchases through in days, and commit to turnaround times. Speed is a control, because it keeps shadow procurement from becoming the norm.
Frequently asked questions
How should vendors be tiered?
By data held, systems reachable, and business impact of failure — not by contract value.
Are questionnaires effective?
Only as a starting point. Independent audit evidence and contractual commitments carry far more weight for critical vendors.
Which contract terms matter most?
Incident notification timelines, audit rights, sub-processor disclosure, data location and deletion, security commitments, and exit assistance with usable data return.
How do we handle concentration risk?
Map shared upstream dependencies across vendors and document how the business operates during an extended outage of each critical one.