Third Party Risk Management and Vendor Assessment

By tiering them, so effort follows risk instead of being spread evenly. Tiering usually considers what data the vendor handles, particularly personal or regulated data, whether they connect into your network or code, how critical they are to services you must keep running, and how hard they would be to replace. A payroll platform holding employee data and a cloud hosting provider running production sit in the top tier and need evidence-based due diligence; an office supplier needs almost none. The register matters as much as the method: most organisations underestimate their vendor count because procurement, engineering and marketing each sign their own tools. We build the inventory first, often from accounts payable and single sign-on records, then agree a tiering model your team can apply consistently. We also record an owner for each vendor inside your business, because assessments stall when no one is accountable for chasing a supplier who does not reply.

It is a start, not the job. A questionnaire records what a vendor says about itself at one moment, and the answers are often written by a sales team. For vendors in higher tiers, pair it with evidence: a current SOC 2 report or ISO 27001 certificate with its scope statement read carefully, penetration test summaries, and specific answers about where your data is stored, who can access it and how incidents are notified. Then check the contract carries the terms you rely on. For the highest tier, add periodic reassessment and monitoring of external signals. The common failure is a folder of completed questionnaires nobody has reviewed since onboarding, which gives assurance in name only. We also set a reassessment cadence per tier, so the programme has a rhythm rather than an annual scramble, and a vendor whose certificate has lapsed or whose scope never covered your service is caught during the year rather than during your own audit.

At minimum: clear purpose and permitted use of your data, confidentiality, security obligations proportionate to the risk, incident and breach notification with a deadline short enough for your own reporting duties, restrictions and approval on subcontracting with equivalent terms flowed down, audit or evidence rights, return or deletion of data at the end of the contract, and cooperation with regulatory or customer audits. Where personal data is involved, the contract needs the processor terms the DPDP Act and, for EU data, Article 28 of the GDPR require, plus transfer mechanisms where data leaves a jurisdiction. Contracts are where third party risk work usually stalls, because renegotiation takes time. We prioritise the vendors where the gap between contract and actual risk is widest. We also keep a simple record of which clauses each vendor actually agreed, because relying on your standard template when the signed agreement says something weaker is a gap that only surfaces during an incident.

It feeds them directly. ISO 27001 expects supplier relationships to be managed and monitored, SOC 2 examines vendor management as part of the common criteria, and PCI DSS requires service provider due diligence and monitoring where card data is involved. Under the DPDP Act, a Data Fiduciary remains accountable for processors acting on its behalf, so the processor register, contracts and oversight are evidence of that accountability. For regulated financial entities, supervisory expectations around outsourced IT and third-party arrangements sit on top. One vendor inventory, one tiering model and one evidence trail can serve every one of those, which is why we build the programme once rather than answering each audit separately. We also keep the register in a form auditors can read directly, with tiering rationale, assessment dates and evidence attached to each vendor, so the same record answers an ISO 27001 auditor, a SOC 2 auditor and a customer questionnaire without being rebuilt each time. That reuse is where most of the saving comes from.

For most organisations, six to twelve weeks to a working programme, following our phases. The vendor inventory and tiering take one to two weeks, designing the assessment framework one to two, the first round of due diligence on the vendors that matter three to six, and risk treatment and contract work two to four, with monitoring and governance running from then on. The pace depends mainly on how quickly vendors respond and how many contracts need changing, neither of which is fully in your control. We usually run the top tier first so the programme produces evidence early, then work down. Ongoing cost is far lower than the initial pass, because later assessments start from what is already recorded. We also hand over the framework and templates so your team can run later rounds without us, which is usually what makes the programme survive its second year.

We do not publish a figure, because the work scales with your vendor population. The quote depends on how many vendors you have and how many fall into tiers that need real due diligence, whether personal or regulated data is involved, how many contracts need reviewing or renegotiating, whether you want us to run assessments or to build the framework for your team to run, and whether ongoing monitoring and reporting are included. Tooling, if you choose a third party risk platform, sits outside our fee, and many organisations start well with a structured register and a defined process. We scope after seeing your vendor inventory, then give you a fixed price in writing, phased so the highest-risk vendors are assessed first. We also make clear what you can run internally, since a competent team with a good framework can handle most lower-tier assessments and reserve outside help for the vendors that carry real risk.