What is vendor risk management?
Short answer
Vendor risk management is how an organisation finds, rates and controls the risks its suppliers bring, from checks before signing to monitoring and a planned exit.
Key takeaways
- Vendor risk management, also called supplier risk management or third-party risk management, controls what could go wrong with a supplier for as long as the organisation works with it.
- Not every supplier needs the same checks. Rate each one on what it touches (data, systems, money, critical services) and set the depth of checks and the review cycle by tier.
- Due diligence before signing covers identity and ownership, sanctions, finances, information security, data protection, continuity and subcontractors.
- The contract turns the findings into rights: audit, security and data terms, notice of incidents, approval of subcontractors, and an exit plan.
- Using a supplier does not move the responsibility. US banking supervisors and DORA say the buyer stays responsible, and the GDPR lets it use only processors that give sufficient guarantees.
What does vendor risk management mean?
Vendor risk management is the work of finding what could go wrong with a supplier, deciding which risks matter given what the supplier does, and controlling them from selection to exit. It runs before the contract (due diligence), in the contract (clauses) and after it (monitoring, review and a planned exit).
The same work is also called supplier risk management or third-party (vendor) risk management; the FAQ below explains the difference. The questions do not change: what can this supplier break, how likely is it, and what do we do about it?
A simple case shows the scope. A company moves its payroll to an outside provider. The provider now holds every employee’s salary and bank details, and if its system stops, nobody is paid. Before signing, the company checks the provider’s security and finances. In the contract, it sets data protection terms and a right to audit. After go-live, it reviews the provider each year and keeps a plan to move payroll elsewhere if the provider fails.
Vendor risk management is one stage of supplier management, which also covers registration, qualification, referencing, performance and renewal. Risk work meets the purchasing cycle at payment: the money goes out only to a supplier that passed its checks, on verified bank details.
Why does vendor risk management matter?
Vendor risk management matters because the buyer keeps the responsibility when it hands work to a supplier. The 2023 US interagency guidance on third-party relationships says that using a third party does not reduce a bank’s responsibility to operate safely and comply with the law. DORA states the same for EU financial entities and their ICT suppliers (Article 28), and the GDPR makes an organisation use only processors that give sufficient guarantees on data protection (Article 28).
The losses are concrete. Business email compromise is a fraud where a criminal pretends to be a supplier or a manager, often to change where a payment goes. The FBI’s Internet Crime Complaint Center recorded 24,768 such complaints in 2025, with reported losses of about $3.05 billion, and that counts only the victims who filed a complaint. A typical case: accounts payable receives an email from a known supplier’s address asking to pay the next invoices into a new bank account. If nobody calls the supplier on a number already on file, the money is gone.
Other failures cost less money but more time. A sole supplier of a key part goes bankrupt and a production line stops. A software provider suffers a data breach and the buyer must notify its own customers. A subcontractor three levels down is found using forced labour. Each of these could have been seen earlier with the right check at the right moment.
What types of vendor risk are there?
Vendor risks fall into a small number of types. The table gives each type, a situation a procurement team would recognise, and the first check that reduces it.
| Risk type | Typical situation | First check |
|---|---|---|
| Financial | A supplier stops trading in the middle of a contract | Financial statements or a credit report before award; alerts during the contract |
| Operational and delivery | Deliveries arrive late or incomplete for several months | References, capacity questions, then delivery measures on the scorecard |
| Information security | A software supplier with access to your systems is hacked | Security questionnaire, certificates or audit reports, scaled to the access given |
| Data protection | A supplier processes customer or employee personal data | Data processing terms and the list of the supplier’s own subcontractors |
| Compliance | A supplier or its owner appears on a sanctions list, or pays bribes | Sanctions and ownership screening before the first order, then on a schedule |
| Concentration | One supplier holds a critical service with no second source | Map critical services to suppliers; plan a second source or an exit |
| Fraud | A request arrives to change the supplier’s bank account | Independent call-back to a known contact; two people to change and pay |
| Reputation and sustainability | Labour or environmental abuse is found in the supplier’s chain | Supplier code of conduct, questionnaires or ratings for high-risk categories |
| Subcontractor (fourth party) | The supplier passes part of the work to another company you never checked | A clause that requires notice and approval of subcontractors |
Most suppliers carry only two or three of these risks in a serious way; the tiering step decides which ones to check for each supplier.
A “fourth party” is simply your supplier’s supplier. A cloud software vendor, for example, often runs on a large hosting provider. If that hosting provider fails, your vendor fails too, even though you have no contract with it. Ask each important supplier which subcontractors it relies on for the service it sells you.
How do you tier vendors by risk?
You tier vendors by rating the risk of the relationship before any control is applied, often called inherent risk. A short intake form, filled in by the person who asks for the supplier, answers a few questions. Will the supplier access our systems or personal data? Will it handle money or goods on our behalf? Would its failure stop a critical service? How much will we spend? Where is it based, and is the activity regulated?
The answers place the supplier in a tier, and the tier sets the depth of checks. The pattern below is an example to adapt, not a standard; each organisation writes its own thresholds in its policy.
| Tier | What places a supplier here | Checks before signing | Review cycle (example) |
|---|---|---|---|
| Critical | Its failure would stop a critical service, or it holds sensitive data at scale | Full due diligence, security assessment, financial review, site visit or audit, tested exit plan | Yearly full review, continuous alerts, review after any incident |
| High | Access to systems or personal data, or a large share of a category’s spend | Full questionnaire, certificates or audit reports, data processing terms | Yearly review |
| Medium | Moderate spend, no sensitive access, alternatives available | Short questionnaire, sanctions and financial screening | Every two or three years, or on an event |
| Low | Low spend, no access, easy to replace (stationery, one-off services) | Identity, sanctions screening, verified bank details | Only when an event triggers a check |
Tiering is what makes vendor risk management affordable: deep checks for the few suppliers that could hurt you, light checks for the many that cannot.
This follows the main idea of the US interagency guidance: the effort at each stage should match the risk and the criticality of the activity. The guidance describes critical activities as those whose failure could cause significant risk, significant customer impact, or a significant effect on the organisation’s finances or operations. Each organisation decides which of its activities fit that description.
What does vendor due diligence check?
Vendor due diligence checks, before the contract, that the supplier is who it says it is and can do the work safely. The list below covers the usual areas. A low-tier supplier gets the first three; a critical one gets all of them in depth.
- Identity and ownership. The legal entity exists in an official company register, and you know who owns and controls it. One supplier record per legal entity avoids duplicates that hide risk.
- Sanctions and compliance. The supplier and its owners are screened against sanctions lists. The US Treasury’s sanctions compliance framework says the risk assessment should guide how much due diligence is done at points such as onboarding, and it names the supply chain among the areas to assess.
- Bank details. The bank account belongs to the supplier, checked through an independent channel, not only from the document the supplier sent.
- Financial health. Accounts or a credit report show whether the supplier can last the length of the contract, especially when you will depend on it.
- Information security. A questionnaire scaled to the access the supplier will have, plus evidence: an ISO/IEC 27001 certificate, whose controls include a group on supplier relationships (Annex A 5.19 to 5.23), or a SOC 2 report, in which a certified public accountant (CPA) examines a service organisation’s controls for security, availability, processing integrity, confidentiality or privacy.
- Data protection. If the supplier will process personal data for you, the GDPR asks you to use only processors that give sufficient guarantees, and to sign a contract with set terms.
- Business continuity. How the supplier would keep the service running, or restore it, after a fire, a cyberattack or the loss of a key subcontractor.
- Insurance and certificates. Liability insurance and any certificates the category requires, with their expiry dates recorded so they can be renewed.
- Subcontractors. Which other companies will do part of the work, and in which countries.
Read the evidence, not only the answers. A questionnaire that says “yes, we encrypt all data” is a claim; a certificate with its scope, or an audit report with its exceptions, is evidence. Check that the certificate covers the service you are buying and not another part of the company.
Which contract clauses control vendor risk?
The contract turns what due diligence found into rights you can use later. Without the right clause, you cannot ask for an audit, demand notice of a breach or leave cleanly. The US interagency guidance lists the topics to negotiate with a third party. They include performance measures, the right to audit and require fixes, confidentiality, business continuity, subcontracting, and default and termination.
- Right to audit
- You, or an auditor you choose, may check the supplier’s controls, and the supplier must fix what the audit finds.
- Security and incident notice
- The supplier keeps agreed security measures and tells you about a breach or outage within a set time.
- Data protection terms
- For personal data, the GDPR lists what the contract must say: the supplier acts only on your documented instructions, keeps the data confidential and secure, uses other processors only with your authorisation, helps you meet your duties, deletes or returns the data at the end, and allows audits.
- Subcontracting
- The supplier must tell you before it passes work to another company, and you may object.
- Service levels and remedies
- Measured targets, and what happens when they are missed: service credits, an improvement plan, then termination.
- Exit and transition
- On termination, the supplier hands back your data in a usable format and helps move the service to a new provider for a set period.
How contracts are drafted, negotiated and followed through their life is the subject of the contract management guide. For vendor risk, the point is simple: each risk rated high at due diligence needs a clause that gives you a way to act on it.
How do you monitor vendor risk after signing?
You monitor vendor risk in two ways: a scheduled review set by the tier, and an immediate check when an event occurs. A critical supplier is reviewed every year in full; a low-tier supplier is reviewed only when something happens.
Events that should trigger a new assessment include:
- A request to change the supplier’s bank account, name or address.
- A change of owner, a merger or a sale of the business.
- News of financial trouble, late tax filings or a credit rating downgrade.
- A data breach, a cyberattack or a long outage at the supplier or its subcontractor.
- A new sanctions listing that names the supplier, its owners or its country.
- Several missed deliveries or failed service levels in a row.
- A change in what you buy: the supplier is about to receive personal data or system access it did not have before.
Monitoring links to performance. A supplier that misses deliveries is a performance problem today and may be a financial problem tomorrow. Keep risk and performance data in the same supplier record so the category manager sees both before deciding to renew.
Monitoring ends with exit. For critical suppliers, write the exit plan before you need it: where the data goes, who takes over, and how long the old supplier must keep helping. A supplier removed from the approved list is still paid for what it delivered; a payment block is only for disputes, suspected fraud or a legal reason.
How do you set up a vendor risk management program?
A vendor risk management program is the written policy, roles and routine that make every part of the organisation treat supplier risk the same way. It can start with the suppliers you already pay.
- List the suppliers you pay. Take the vendor master and the last year of payments, and merge duplicates. This is the inventory the program covers.
- Write the tiering rules. Agree the intake questions and the thresholds for each tier with procurement, information security, legal or compliance, and finance.
- Tier the existing suppliers. Start with those that touch data, systems, money or critical services; leave the many small, low-risk suppliers for later.
- Set the checks per tier. One questionnaire and a list of evidence for each tier, so that a low-tier supplier is not sent a 300-question form.
- Name owners. Each high or critical supplier has a business owner who answers for the relationship, with information security and compliance as reviewers.
- Fix the contract templates. Add audit, security, data, subcontracting and exit clauses to the templates used for high and critical suppliers.
- Set the review cycle and the triggers. Put the review dates in the supplier record and agree who receives event alerts.
- Report to management. Show the share of spend and of critical suppliers that are tiered, checked and reviewed on time, and the open issues.
Procurement usually owns the process and the intake. Information security assesses technical risk. Legal or compliance owns sanctions and contract terms. Finance controls bank details and payment. The business owner decides whether to accept a remaining risk. Without that split, the questionnaire is sent but nobody reads the answers.
What is IT vendor risk management?
IT vendor risk management is vendor risk management applied to software, cloud and technology suppliers. The steps are the same, but the main risks are data, system access, service availability and lock-in, that is, how hard it is to change provider later. A cloud HR system, for example, holds every employee’s personal data and is reached from the internet, so it sits in a high tier even when its yearly cost is small.
In the European Union, rules now require this work from many organisations. The NIS2 Directive (EU) 2022/2555, which Member States had to apply from 18 October 2024, lists supply chain security among the cybersecurity measures that essential and important entities must take, including the relationships with their direct suppliers and service providers. Entities must consider each supplier’s specific weaknesses and the quality of its products and security practices. Financial entities also fall under DORA, which since 17 January 2025 requires a register of all contracts for ICT services and separate treatment of those that support critical or important functions.
Outside regulated sectors, the same practices work well: an inventory of software suppliers and the data each one holds, security evidence scaled to access, data processing terms, and an exit plan that includes getting your data back in a format another system can read.
Which tools support vendor risk management?
Vendor risk management tools range from a spreadsheet to a dedicated platform. A small organisation with a few dozen important suppliers can run tiering, questionnaires and review dates in a shared register. As volumes grow, the work moves to software that sends questionnaires, stores evidence and expiry dates, scores answers and receives alerts from outside data such as credit ratings, sanctions lists and news.
A vendor risk management platform is often part of a wider supplier management suite, which also handles registration and performance; the supplier management software guide explains those suites and how to compare them. Specialist risk platforms add deeper monitoring of security, finances or sustainability. A guide to choosing vendor risk management software is in preparation.
Whatever the tool, test it on your own cases: a new supplier that needs access to customer data, a bank account change request, and an alert about a supplier’s owner. Watch who receives the task, what evidence is asked for, and whether the decision is recorded in the supplier record.
Questions
What is the difference between vendor risk management and third-party risk management?
Third-party risk management is the wider term. It covers every outside party an organisation works with, including partners, agents and joint ventures, while vendor risk management covers suppliers only. Banks and regulated firms tend to use the wider term because their supervisors do; most procurement teams use vendor or supplier risk management.
Is supplier risk management the same as vendor risk management?
Yes, for practical purposes. Supplier risk management is the usual name in procurement and manufacturing, and vendor risk management the usual name in IT, finance and US usage. Both describe the same work: tiering suppliers, checking them before signing, writing risk clauses into contracts, monitoring them and planning their exit.
Who is responsible for vendor risk management?
The organisation that buys stays responsible, even when a supplier does the work. Inside it, procurement usually owns the process, information security and compliance assess specific risks, finance controls bank details and payment, and a named business owner accepts or rejects the remaining risk for each important supplier.
How often should vendors be reassessed?
It depends on the tier. A common pattern is a full yearly review for critical and high-risk suppliers, every two or three years for medium-risk ones, and checks only on events for low-risk ones. Events such as a bank account change, a change of owner or a data breach trigger a new assessment at any time.
What is a vendor risk assessment?
A vendor risk assessment is the evaluation of one supplier against the risks that matter for what it will do: a questionnaire, evidence such as certificates or audit reports, screening results and a rating. Its result decides whether to sign, which contract clauses to add and how often to review the supplier.
New guides on the supplier management line
One short email when a guide on this line is added or revised. Nothing else.
Coming soon: sign-up opens with the first email.