What Is Vendor Risk Management?

Vendor risk management is the programme that identifies, assesses and monitors the risk carried through suppliers. It is the operational answer to third-party risk, and in most organisations it consumes considerable effort while changing very little.

The reason is consistent: programmes assess everything at the same depth, using questionnaires, at the moment of onboarding, and then stop.

Tiering is what makes it affordable

A vendor holding regulated data or administrative access warrants genuine scrutiny. A vendor supplying office furniture does not. Assessing both to the same standard guarantees the first receives insufficient attention.

Tiering criteria worth using: what data they hold, what access they have, whether their outage stops operations, and whether their code runs in your environment. Two or three tiers with clearly different requirements is enough.

Why questionnaires disappoint

They record what the vendor says, completed by someone motivated to answer well, describing intentions as accurately as practice. They also arrive in incompatible formats and consume effort on both sides.

More informative: an independent report or certificate with its scope read, penetration test summaries, and for the highest tier a conversation with their security team about specifics. Best of all is what you can establish yourself about what their access reaches.

The contract is the only real control

Assessment produces information; the contract produces obligations. Terms worth insisting on for critical vendors: security requirements, incident notification with a stated timeframe, audit or evidence rights, subcontractor disclosure, data handling and return on termination, and liability that is not capped at one month's fees.

Those are negotiated at signature and effectively unavailable afterwards, which is why security involvement before contract execution matters more than any assessment.

Ongoing monitoring, which mostly does not happen

Assessment at onboarding describes the vendor on that day. Environments change, ownership changes, incidents occur, and security posture degrades.

Practical continuing measures: periodic reassessment for the top tier, external rating services for change signals, monitoring of breach disclosures, and reviewing their access rights on the same cycle as internal privileged access.

Offboarding is the neglected end

Access revoked, data returned or destroyed with evidence, integrations disabled, credentials rotated, and the relationship removed from the inventory.

This is the step most consistently skipped, which is why organisations regularly find active accounts and live integrations belonging to vendors they stopped using years ago.

Shadow procurement is where the inventory fails

Departments adopt software on a corporate card, sign click-through terms and connect it to corporate data without any review. Those relationships are absent from the vendor inventory by definition, which makes the inventory incomplete in exactly the places nobody assessed.

Expense data and identity provider application logs are usually better discovery sources than the procurement system. Finding what is already in use is generally more productive than tightening the process for what comes next.

Where to start

Review your vendor inventory for relationships that ended and check whether their access was removed. That exercise is short and consistently finds live access nobody intended to leave open.

See fixing vendor risk assessment and what to measure. GuardsArm runs security risk assessments.