Vendor risk management: the complete guide

Your company can have flawless internal controls and still be hurt badly by a supplier it barely thinks about. A payroll provider has a breach. A key component maker loses its factory to a fire. A marketing agency posts something that makes the news and your logo is next to it.

In each case the problem began outside your walls and landed inside them. Vendor risk management exists to see those problems coming.

What vendor risk management is

Vendor risk management, also called third-party risk management, is the process of identifying, assessing, controlling and monitoring the risks that arise from using outside suppliers. It runs before you sign, while the relationship lasts and as it ends.

The risks that suppliers bring

Step 1: Know who your vendors are

You cannot manage risk for suppliers you cannot list. Build a single inventory of every vendor with annual spend, internal owner, what they provide and what data or systems they touch. Expect surprises: departments buy things without telling anyone.

Step 2: Tier your vendors

Not every vendor needs the same scrutiny. Sort them by the damage they could cause.

A useful tiering question is: what happens to us if this vendor disappears for a week?

Step 3: Assess before you sign

For higher tiers, collect evidence, not just answers. A questionnaire tells you what a vendor says. Documents show what they have.

• Financial health. Recent accounts, credit reports or funding status.
• Security evidence. Independent audit reports, penetration test summaries and policies. Ask what they cover and when they were issued.
• Compliance. Licenses, certifications, sanctions screening and data protection commitments.
• Insurance. Certificates showing cover for liability, cyber and professional indemnity where relevant.
• Business continuity. How they handle outages and how quickly they recover.
• References. Call two customers of similar size to you.

Our vendor due diligence checklist lists the checks in order, and the vendor risk assessment template gives you a scoring sheet to start from.

Step 4: Put protections in the contract

• Security and data protection requirements, with the right to audit.
• Breach notification within a set number of hours.
• Service levels with remedies if they are missed.
• Subcontractor approval or notice.
• Business continuity obligations.
• Termination rights, data return and deletion.
• Insurance requirements.

See what is contract management for keeping track of these obligations once they are signed.

Step 5: Monitor continuously

A clean assessment on day one says little about year three. Monitor for change.

• Refresh evidence on a schedule that matches the tier.
• Watch for news about financial trouble, breaches, ownership changes and regulatory action.
• Track performance and incident data from your own teams.
• Re-assess whenever the scope of work changes, especially if data access grows.

Step 6: Respond and exit

Write down what happens if a critical vendor fails. Who is called, what is switched on, how long you can operate without them. Exit plans need testing, at least on paper, for your top vendors. When a relationship ends, revoke access, retrieve data, confirm deletion and close the record. See vendor offboarding workflow.

Who owns vendor risk

Risk is shared. Procurement runs the process and keeps the inventory. Information security reviews technical controls. Legal reviews contract terms. Finance checks financial health. The business owner for each vendor owns the day to day relationship and raises concerns. Someone must coordinate, or each group assumes another is watching.

Responding when something goes wrong

Even good programs face incidents. The difference is how fast you can act.

1. Confirm what happened. Ask the vendor for facts: what, when, which of your data or services are affected.
2. Contain. Cut access, rotate credentials, switch to a backup process if one exists.
3. Notify. Inform your security team, legal and leadership. Check whether you have regulatory or customer notification duties and the deadlines that come with them.
4. Record. Keep a dated log of actions and communications.
5. Recover. Restore service and verify.
6. Review. Ask what the contract allows: remedies, audits, termination. Update the vendor's risk rating.
7. Learn. Change the onboarding or monitoring step that would have caught it.

A one-page response plan for each critical vendor, written before an incident, saves hours when it counts.

Common mistakes

1. One questionnaire for everyone. Low risk vendors get overwhelmed and critical vendors get under-checked.
2. Accepting answers without evidence. Self-reported compliance is not proof.
3. Checking once. Risk changes with the vendor and the work.
4. Ignoring fourth parties. Ask your critical vendors who they depend on.
5. No exit plan. Leaving a vendor in a hurry is far harder than planning ahead.

When tools help

A spreadsheet handles a few dozen vendors. Beyond that, you want reminders, evidence storage, scoring and workflow in one place. See the third-party risk management software page and supplier risk management software page.

Questions to ask a critical vendor

1. What data of ours will you hold or access, where is it stored and who can see it?
2. When was your last independent security assessment, and can we see the summary?
3. What happens to our service if your main site or cloud region fails, and how fast do you recover?
4. Which third parties do you rely on for the service you provide to us?
5. How soon will you tell us about a security incident that affects us?
6. Do you carry cyber and professional liability insurance, and at what limits?
7. Have you had any regulatory action or major legal dispute in the last three years?
8. What would the exit look like: how do we get our data back and in what format?

Jargon, decoded

• Inherent risk. The risk a vendor carries before controls are considered.
• Residual risk. The risk left after controls and protections.
• Attestation. A signed statement or independent report about a vendor's controls.
• SOC 2 report. An independent audit report on a service provider's controls over security and related areas.
• Concentration risk. Over-reliance on a single vendor or location.
• Fourth party. A supplier of your supplier.

What to do this month

List your vendors with access to customer or employee data. That list is your starting tier. Send those vendors the eight questions above and read what comes back. The answers, and the vendors who do not answer, will tell you where to look first.

Frequently asked questions

Where to read next

• Vendor due diligence checklistPre-contract checks
• Vendor risk assessment templateScoring framework
• What is vendor managementThe wider discipline
• Supplier risk assessment workflowAutomating the steps