Third-party risk assessment: a practical vendor risk process
Your hosting provider, payment processor, payroll bureau and marketing agency can all cause you a breach, an outage or a fine. A third-party risk assessment tells you which suppliers matter, what to ask them and what to do with the answers — without sending a 300-question spreadsheet to the company that delivers your coffee.
A third-party risk assessment is a structured review of the risks a supplier brings to your organisation — to your data, operations, finances, compliance and reputation — done before you sign and repeated during the relationship. Start by listing suppliers and tiering them by how critical they are. Assess critical and high-tier suppliers in depth, using evidence such as SOC 2 reports and ISO 27001 certificates, and lighter checks for the rest. Record the material supplier risks in your risk register with owners, controls and review dates.
What third-party risk assessment covers
Third-party risk management (TPRM) is the ongoing process; the assessment is the step where you judge a particular supplier. “Vendor risk assessment” usually means suppliers you buy from; “third party” is broader and includes partners, resellers, agents and outsourced service providers. The method is the same.
This guide is about judging someone else’s controls. If you are assessing your own systems and threats, start with a cybersecurity risk assessment — suppliers appear there as one source of risk among many. If you are an APRA-regulated entity in Australia, the specific rules for material service providers are covered in our CPS 230 guide.
Supplier risk is wider than cyber. The main domains are:
| Domain | Example of what can go wrong |
|---|---|
| Information security | A supplier with access to your systems or data is breached, and your customers’ data goes with it |
| Data protection | A processor handles personal data without adequate safeguards or transfers it abroad unlawfully |
| Operational resilience | A platform you trade on goes down for a day, or a logistics partner fails at peak season |
| Financial | A small but critical supplier becomes insolvent, taking service and prepaid fees with it |
| Concentration | Several critical services depend on one cloud provider or one region |
| Fourth party | Your supplier’s own subcontractor fails or is breached |
| Compliance and conduct | A supplier breaches sanctions, anti-bribery, modern slavery or sector rules in your name |
| Reputational | A partner’s behaviour becomes your headline |
The third-party risk lifecycle
Most guidance describes the same cycle. The US banking agencies’ 2023 interagency guidance on third-party relationships, for example, uses five stages: planning, due diligence and selection, contract negotiation, ongoing monitoring and termination. The UK NCSC’s 12 supply chain security principles are grouped into four stages: understand the risks, establish control, check your arrangements and continuous improvement. You do not need either to run a sensible process, but both are good references.
| Stage | Key questions | Output |
|---|---|---|
| 1. Plan | Why do we need this supplier? What will they access? What happens if they fail? | Inherent risk tier |
| 2. Due diligence | Can they protect what we give them and deliver reliably? | Assessment with evidence and findings |
| 3. Contract | Have we written in what we need: security, notification, audit, exit? | Signed terms reflecting the risk |
| 4. Monitor | Is anything changing — incidents, ownership, service, finances? | Periodic reviews, register updates |
| 5. Exit | Can we leave cleanly, get our data back and confirm it is deleted? | Exit plan; closure evidence |
Step 1: build a supplier inventory
You cannot assess suppliers you do not know about. Pull the list from accounts payable and corporate card statements, not just from contracts — SaaS tools bought on a card are the usual blind spot. For each supplier record:
- What they do for you, and which business process depends on them.
- What data they hold or can see, and whether it includes personal, payment or confidential data.
- What access they have to your systems: none, a portal, integrated APIs, administrator access.
- The internal owner — the person who manages the relationship.
- Contract dates, annual spend and where the contract is stored.
Step 2: tier suppliers by inherent risk
Tiering decides how much effort each supplier deserves. Score the risk before looking at the supplier’s controls — that is the inherent risk of the relationship. A simple scoring model works for most small and mid-sized organisations:
| Factor | 1 — low | 2 — medium | 3 — high |
|---|---|---|---|
| Data sensitivity | No data or public data | Internal or limited personal data | Payment, health, large volumes of personal or confidential data |
| System access | None | Limited, user-level | Integrated or privileged access |
| Operational dependency | Outage is an inconvenience | Outage disrupts a process for days | Outage stops trading or a critical operation |
| Substitutability | Easy to replace within weeks | Replaceable within months | Hard to replace; few alternatives |
| Regulatory relevance | None | Indirect | Supports a regulated activity or obligation |
Add up the scores (5–15) and set bands that suit you. An example:
| Tier | Score | Due diligence | Review |
|---|---|---|---|
| Critical | 13–15, or any single 3 on operational dependency | Full questionnaire, independent assurance reports, contract review, exit plan | Annually and after any incident |
| High | 10–12 | Standard questionnaire plus evidence of key controls | Every two years |
| Moderate | 7–9 | Short questionnaire; certificates where available | At renewal |
| Low | 5–6 | Basic checks: company details, standard terms | At renewal, light touch |
Most organisations find that a handful of suppliers are critical and the long tail is low. That is the point: spend your time on the handful.
If you only have an afternoon
A small business does not need a TPRM programme to get most of the benefit. Take the ten suppliers you pay most or would miss most. For each, answer three questions: what would happen if they disappeared tomorrow, what data of ours do they hold, and do we have their security certificate or report on file? Anything that makes you uncomfortable goes in the register with an owner. That single exercise usually finds the two or three supplier risks that genuinely matter — typically the main platform, the payment provider and whoever has administrator access to your systems.
Step 3: ask proportionate questions
Long questionnaires get copy-pasted answers. Ask fewer, sharper questions and request evidence for the ones that matter. Core questions for critical and high-tier suppliers:
Security and data
- Do you hold a current ISO 27001 certificate, SOC 2 Type II report, Cyber Essentials (Plus) certificate or PCI DSS attestation covering the service we use?
- Is multi-factor authentication enforced for all staff and administrative access?
- How quickly do you patch critical vulnerabilities on internet-facing systems?
- Where is our data stored and processed, and which subcontractors can access it?
- Is our data encrypted in transit and at rest, and how is it separated from other customers’?
- When was your last independent penetration test, and were critical findings fixed?
Resilience
- What availability do you commit to, and what was your actual availability over the last year?
- How are backups made and tested? When did you last restore from them?
- Do you have a business continuity plan, and when was it last exercised?
Incidents and governance
- How quickly will you tell us about a security incident affecting our data or service?
- Have you had a material incident or regulatory action in the last three years?
- Who is accountable for security in your organisation?
For financial risk, check filed accounts or a credit report rather than asking. For sanctions and conduct, screening is usually quicker than a questionnaire.
Step 4: check the evidence
Independent assurance saves both sides time, but only if you read it.
| Evidence | What it tells you | What to check |
|---|---|---|
| ISO/IEC 27001 certificate | An information security management system has been audited against the standard | Scope statement covers your service and locations; certificate is current; ask for the Statement of Applicability if the service is critical |
| SOC 2 Type II report | An auditor tested whether controls operated effectively over a period (Type I covers design at a point in time only) | Period covered; exceptions found; carve-outs of subservice providers; “complementary user entity controls” you must operate |
| Cyber Essentials / Plus | Basic technical controls (UK); Plus includes hands-on verification | Scope — sometimes a single office, not the service you buy |
| PCI DSS Attestation of Compliance | The provider has validated its PCI DSS compliance | Which services are covered; date; who is responsible for which requirements |
| Pen test summary | Independent testing took place | Date, scope and whether critical findings were fixed — see our guide to vulnerability assessment vs penetration testing |
| Insurance certificate | Cover exists for cyber or professional liability | Limits relative to your exposure; expiry |
Read the scope first. The most common gap is a genuine certificate that covers something other than the service you are buying — a different product, entity or data centre.
Step 5: write the risk into the contract
Due diligence tells you what the supplier does today; the contract decides what you can insist on tomorrow. For critical and high-tier suppliers, look for:
- Security requirements — the controls you rely on, stated as obligations.
- Incident notification — a specific timeframe, short enough for you to meet your own reporting duties.
- Data protection terms — under UK and EU GDPR, Article 28 requires a written contract with processors containing specific terms, including acting only on your instructions and assisting with breaches.
- Subcontractors — notice of, or right to object to, new subprocessors.
- Right to audit or receive assurance — at least annual delivery of their certificate or report.
- Service levels and remedies — measured in a way that matters to you.
- Exit — data return in a usable format, deletion confirmation and transition support.
Large SaaS providers rarely negotiate their standard terms. Where you cannot change the contract, record the gap and compensate elsewhere — backups you control, a second supplier, or accepting the risk explicitly.
Step 6: record supplier risks in the register
The assessment produces findings. The material ones become risks in your risk register, scored on the same risk matrix as everything else, so a supplier risk can be compared with your other risks. Do not create one risk per supplier by default — create one where a supplier’s weakness or your dependency on it could genuinely hurt.
| Risk statement | Finding | L | I | Score | Treatment | Owner |
|---|---|---|---|---|---|---|
| Ecommerce platform outage stops all online sales | Single platform, no fallback; SLA credits small relative to lost sales | 2 | 5 | 10 | Documented outage plan; customer comms templates; accept residual | Head of ecommerce |
| Marketing agency’s compromised account is used to access customer data | Agency staff have admin access; MFA not confirmed | 3 | 4 | 12 | Enforce MFA; reduce to least-privilege roles; quarterly access review | Marketing manager |
| Payroll bureau breach exposes staff personal and bank data | ISO 27001 certified, scope confirmed; notification clause 72 hours | 2 | 4 | 8 | Annual certificate check; accept | Finance director |
| Critical services concentrated with one cloud provider in one region | Hosting, backups and email all with the same provider | 1 | 5 | 5 | Move backups to a separate provider; test restore | IT lead |
| Small fulfilment partner becomes insolvent at peak | Latest accounts show losses; no second partner | 2 | 4 | 8 | Identify and onboard a back-up partner before Q4 | Operations manager |
Scores are illustrative residual scores. The concentration example shows why low likelihood does not mean low priority — see inherent vs residual risk for how to show the effect of controls.
Step 7: monitor between reviews
An assessment is a snapshot. Between scheduled reviews, watch for signals that should trigger an early one:
- A security incident or outage at the supplier, or at one of its subcontractors.
- A change of ownership, merger or significant layoffs.
- A change in what they do for you — new data, new access, a new integration.
- Expiry of a certificate or report you relied on.
- Repeated SLA failures or slow responses to security questions.
A few key risk indicators keep the programme honest:
| Indicator | Example thresholds |
|---|---|
| Critical and high-tier suppliers with an overdue review | Green 0 · amber 1–2 · red > 2 |
| Critical suppliers without a tested exit or fallback plan | Green 0 · red any |
| Suppliers with access to personal data and no signed data processing terms | Green 0 · red any |
| Supplier incidents affecting us in the last quarter | Track the trend; review each one |
| New suppliers onboarded without an assessment | Green 0 · amber 1 · red > 1 |
How the main frameworks fit
- ISO/IEC 27001:2022 — Annex A controls 5.19 to 5.23 cover information security in supplier relationships, supplier agreements, the ICT supply chain, monitoring of supplier services and use of cloud services.
- NIST Cybersecurity Framework 2.0 — the Govern function includes a Cybersecurity Supply Chain Risk Management category (GV.SC).
- UK NCSC supply chain guidance — 12 principles in four stages, plus practical guidance on applying them.
- PCI DSS v4.0.1 — requirement 12.8 asks merchants to manage the third-party service providers that can affect card data, including keeping a list and monitoring their compliance status.
- UK and EU GDPR — Article 28 sets out what processor contracts must contain.
- APRA CPS 230 — for regulated Australian financial entities, specific requirements for material service providers.
All of them point the same way: know your suppliers, assess in proportion to risk, put it in the contract, keep watching and plan your exit.
Common mistakes
- The same questionnaire for everyone. Low-risk suppliers drown in paperwork while critical ones get the same light touch. Tier first.
- Collecting certificates without reading them. Check scope, dates and exceptions.
- Assessing once at onboarding. Suppliers change; so does what you give them.
- Only looking at cyber. Insolvency, concentration and conduct risk cause real losses too.
- No exit plan. The worst time to discover you cannot get your data back is when you need to leave.
- Risk owned by procurement alone. The business owner of the relationship should own the risk; procurement and security support the assessment.
- Findings that go nowhere. If a gap is not fixed, contracted around or explicitly accepted in the register, it was not managed.
Frequently asked questions
What is a third-party risk assessment?
A structured review of the risks a supplier, vendor or partner brings to your data, operations, finances, compliance and reputation, done before signing and repeated during the relationship. Its depth should match how critical the supplier is.
What is the difference between TPRM and vendor risk management?
Vendor risk management usually covers suppliers you buy from. Third-party risk management is broader and includes partners, agents, resellers and outsourced providers. The process is the same.
How do you tier vendors by risk?
Score each supplier on data access, system access, operational dependency, substitutability and regulatory relevance, then group them into tiers. The tier sets the depth of due diligence and the review frequency.
Is a SOC 2 report or ISO 27001 certificate enough?
They are strong evidence, not the whole answer. Check scope, dates, exceptions and the controls you are expected to operate. They say nothing about financial stability or concentration risk.
How often should vendors be reassessed?
Commonly annually for critical suppliers, every two years for high, and at renewal for the rest — plus immediately after a supplier incident, a change of ownership or a significant change in the service.
Supplier risks in the same register
In Risk Samurai supplier risks sit next to your other risks, with owners, evidence, review dates and indicators — so a critical vendor’s expiring certificate or overdue review is visible before it becomes a problem. AI drafts the first version of your register.
Get early access