HomeVendor risk management guides
Vendor risk
Vendor risk management guides
Supplier risk is easy to ignore until one supplier fails. These five pages help you decide what to check, how much to check it and when to look again.
By Procurement VMS Editorial TeamLast updated
- Guides
- 5
- Start with
- The complete guide
- Includes
- Assessment, due diligence, compliance, software
- Related tool
- Free risk template
Why this matters
The risk you never listed
Ask a procurement lead which supplier would hurt most if it vanished tomorrow, and the answer often surprises the room. It is rarely the biggest name. It is the small firm that makes one part, hosts one system, or holds one licence. Risk management is a way of finding that firm before it finds you.
The guides
Five pages, one programme
- Vendor risk management: the complete guideWhat supplier risk is and how to run a programme around it.
- Vendor risk assessment templateA scoring framework across five domains.
- Vendor due diligence checklistA long list of checks before you commit.
- Vendor compliance managementKeeping certificates and obligations current.
- Third party risk management softwareWhat the tools do and how to choose.
A sensible order
How to build a programme without drowning
Sort your suppliers into tiers first. A cleaning contractor and a payments processor should never get the same questionnaire.
Do deep checks only on the top tier, and light checks on the rest. Depth should follow impact.
Set a review date for each tier. High risk suppliers are looked at every year at least, others less often.
Keep one record per supplier. When evidence lives in five inboxes, it effectively does not exist.
Risk tiers
A simple three tier model
| Tier | Who sits here | What you do |
|---|---|---|
| High | Critical suppliers, data handlers, single source items | Deep due diligence, yearly review, exit plan |
| Medium | Important but replaceable suppliers | Standard questionnaire, review every two years |
| Low | Commodity, low value, easy to replace | Basic identity checks only |
Keep the tiers few. Three is enough for most companies.
Early warning signs
What to watch for between reviews
Late deliveries that become a pattern, or a sudden change in the people you deal with.
Requests to change payment details, terms or the legal entity on an invoice.
News of layoffs, legal trouble or a sale of the business.
Certificates that quietly expire or arrive late.
Want a shortlist for your team?
Tell us your company size and region. We use AI to match you to products, and a person checks the list before it reaches you, with the reason behind each pick.
Disclosure: Zapro AI appears on some comparison pages as an editor's pick, and the people behind this site have a professional connection to Zapro AI.
Request received
We will email your shortlist, usually within one business day. While you wait, browse the related guides above.
Questions
Frequently asked questions
What is the difference between vendor risk and third party risk?
They overlap heavily. Third party risk is the wider term and can include partners, agents and resellers, while vendor risk usually means suppliers you pay.
How many suppliers should be in the high risk tier?
Few. If more than a fifth of your suppliers are high risk, the tiering rules are probably too loose to be useful.
Can a spreadsheet run a risk programme?
For a small number of suppliers, yes. Beyond that, reminders, evidence storage and audit trails are hard to keep up by hand.
How often should I review high risk suppliers?
At least yearly, and whenever there is a trigger such as a security incident, a financial warning or a change of ownership.
Who should own supplier risk?
Usually risk or procurement leads the programme, with each business owner accountable for their own suppliers.