How to Conduct Your Vendor Risk Assessment Process

By James Kim

With the proliferation of technology and globalization over the last several decades, companies are becoming more reliant on third-party vendors and service providers than ever. 

According to Deloitte's Global Outsourcing Survey 2020, more than 70% of respondents pointed to cost reduction as their key driver for outsourcing, with around 40% agreeing that increased flexibility was a secondary motivation.

In another Statista report, it's predicted that the global spend on IT outsourcing will hit $1.3 trillion by the end of 2023. Clearly, this brings with it a heightened concern about data breaches. 

To mitigate this, leading organizations have implemented a comprehensive risk management program that includes conducting a vendor risk assessment to identify the potential risks associated with their third-party vendors — whether that's reviewing vendors' policies or combing through existing contracts to check the contingencies.

Here's what you need to know about vendor risk assessment best practices — and how you can streamline your organization's processes to reduce your level of risk and protect your firm's sensitive data. 

The Key Facts on Vendor Risk Management

Organizations use vendor risk management programs (VRM) to identify, assess, and manage the risks associated with their vendors. While new security threats and vulnerabilities are always developing, VRM helps organizations stay on top of these changes and put the right security controls in place. Vendor risk assessments play a large part in these processes.

A vendor risk assessment questionnaire focuses on identifying the potential risks that can have a big impact on business operations. When done right, it empowers business leaders to make confident decisions about the direction of the third-party risk management processes in their corporate value chains.

While any organization can (and should) carry out regular vendor risk assessments, doing so is especially important for companies that handle customers' sensitive data, such as those subject to stringent regulations like the Payment Card Industry Data Security Standard (PCI DSS) in financial services or the Health Insurance Portability and Accountability Act (HIPAA) for healthcare insurers.

When Do You Conduct a Vendor Risk Assessment?

It's important that you conduct thorough due diligence on your potential new vendors' capabilities, financial standing, and operational track record before entering into a business relationship with them — or even before you renew a contract with a current vendor.

For example, if your organization is looking to work with an offshore software development company, your team should perform a vendor risk assessment as part of the procurement process to ensure the provider has adequate cybersecurity measures to protect your sensitive business data from a breach.

There are various other stages in your third-party risk management processes where it might be appropriate to conduct a risk assessment. For example:

• When looking for potential vendors during procurement
• During the vendor onboarding process
• Throughout the life of the contract, to check compliance at various intervals
• When investigating a risk event or incident

Companies that outsource a significant proportion of their core business functions should also consider automating this assessment process to take place at least once a year. That way, each vendor relationship can include updated policies and fewer unexpected risk events.

Keeping up-to-date with this process will help your business avoid serious legal issues or reputation damage in the future.

What Effective Vendor Risk Assessment Means for Your Business

An effective VRM program helps your team to identify risks that could threaten your business operations and put the safeguards in place to mitigate them before they become a reality.

Other benefits of vendor risk management include:

• Streamlined processes and the reduction of unnecessary costs
• Easier regulatory compliance through better reporting processes and visibility across your partners, contractors and suppliers
• Better risk intelligence to identify and respond to threats faster, reducing the impact on your business
• Decreased risk of regulatory fines through improved compliance programs and increased visibility across your supplier base
• Building trust with your business partners and key stakeholders, making them more likely to work with you in the future
• Improving your business’s competitiveness, allowing leaders to focus on achieving goals rather than worrying about managing complex security issues with third parties
• Increased confidence in the level of service provided to customers — knowing that your partners share your same high standards of data protection and security

How to Score Your Vendor Risks

To help your risk management team easily assess and benchmark the vendor risks within your supply chain, use vendor scorecards. A vendor scorecard makes it easy for you and your leadership team to spot and prioritize the vendor-related risks that need urgent attention, so you can tailor your remediation efforts toward high-risk vendors.

First, start by identifying and organizing all the vendors and service providers in your supply chain. It's a good idea to use a dedicated third-party lifecycle management (TPLM) tool like Certa to help you keep track of your vendor list in one place.

Once you have full visibility of your third-party suppliers, work with your key stakeholders to determine which types of vendor risk and third-party risk factors you want to evaluate, plus the priority level for each of these factors. 

Here are some example questions to consider:

• To avoid compliance risk, is the vendor compliant with all applicable laws and regulatory requirements? For example, check if the vendor is subject to any ESG reporting requirements under a different jurisdiction or data privacy regulations like the General Data Protection Regulation (GDPR). 
• Does the vendor have business continuity plans in place in case it can't provide the required services? You'll want assurance the organization has secured itself against operational risk events such as power outages, equipment failures, or loss of power because of a natural disaster, etc.
• Is there enough diversification in your supply chain to avoid concentration risk, especially regarding the fourth-parties used? Avoid having all your key suppliers in the same geographic region or using the same software providers.
• Has the vendor undergone the relevant certifications or SOC audits to make sure they have the right data controls in place? If your software vendor has a current SOC 2 report or ISO 27001 certification, for example, that would verify it has adequate information security measures to safeguard its servers from unauthorized access, malware infections, and other malicious attacks. 
• Do you have appropriate contractual terms in place with third-party suppliers to minimize the risk level of legal or reputational issues in the event of unethical behavior from a vendor?

With Certa, you can create your own bespoke risk framework to help you score your vendors on each of these risk factors, based on your level of concern regarding that factor.

Comparing scores across your entire supply chain can support your gap analysis efforts to identify areas that need improvement. Overall, these scores will support your team's decision-making around your supply chain risk management processes.