Third-party risk management: a vendor assessment checklist that survives an audit
Most organisations know their vendors. Fewer can show how each was assessed, rated and approved. A practical checklist for third-party risk management, from discovery to Board decision.
Key takeaways
- Build the vendor list from what you actually pay, not from an old register.
- Tier vendors by what they can touch, and assess in proportion to the tier.
- A rating is only useful if someone else could reproduce it from the recorded inputs.
- Every assessment ends in a recorded decision with a named owner, and gaps are tracked to closure.
When an auditor or a regulator looks at third-party risk, the question is rarely whether you have a vendor list. It is whether you can show, for a given vendor, why it was rated the way it was, who approved it, and what happened to the gaps.
That is the difference between a list and a programme.
Step 1: find the vendors you actually pay
The register someone built two years ago is usually incomplete. The more reliable sources are the accounts payable ledger and the purchase records. Start there, then add vendors that hold no contract but have access to your systems or data. A vendor you do not know about cannot be assessed.
Step 2: tier them by what they can touch
Not every vendor deserves the same scrutiny. Tier by impact:
- Access to data: personal, financial or confidential
- Access to systems: production, networks, administrative access
- Dependence: can the business run without them for a day, a week
- Regulatory weight: is the service itself something a regulator expects you to oversee
Write the tiering rule down so two reviewers reach the same answer. Try one below.
Tier 3: low
Short assessment or a self-declaration, kept on record, and reviewed on an event such as a service change.
An example rule. Set your own, write it down and apply it the same way to every vendor.
Step 3: assess in proportion
A critical vendor needs a full assessment. A low-risk vendor needs a short one. A long questionnaire sent to everyone yields late, thin answers. Good practice is to:
- 1Use a standard question set per tier
- 2Ask the vendor to answer one section at a time, so it is not a single overwhelming form
- 3Ask for evidence for the answers that matter, such as a certificate, a report or a policy
- 4Set a due date and chase it
Step 4: rate in a way you can defend
A rating is only useful if someone else could reproduce it. Record the inputs, the weighting and the reviewer, and keep the vendor's evidence with the rating. Avoid ratings that rely on one person's judgement and leave no trail.
Step 5: decide, and record the decision
Every assessment ends in a decision: accept, accept with conditions, remediate, or exit. The decision belongs to a named owner, and decisions above a certain risk level go to a senior committee or the Board.
Watch for. If the decision is not recorded, it did not happen. The most common audit observation in this area is an assessment that found a gap and never followed it up.
Step 6: track the gaps to closure
Findings need an owner, a due date and a status. Review critical vendors at least annually, and reassess earlier on an event such as a breach, an ownership change or a change in the service.
Your checklist
Doing it in one place
Netra's Third-Party Risk module follows this flow: vendors are discovered from accounts and purchase lists, a vendor portal collects assessments one section at a time, ratings come with the evidence behind them, and a Board pack lists the decisions that need to be taken. Because it is connected to the rest of Netra, a vendor finding can also become a task, a risk or an audit observation without being retyped.
This article is for general information. Your regulator or contracts may set specific requirements for outsourcing and vendor oversight.
Frequently asked questions
Where should a vendor list start?
With what the organisation actually pays, not an old register.
How should vendors be tiered?
By what each vendor can touch, with assessment in proportion to the tier.
What makes a vendor rating defensible?
Someone else could reproduce it from the recorded inputs, and every assessment ends in a recorded decision with a named owner.
Ratings you can defend
Vendor discovery, assessments, ratings and a Board pack in one connected module.
See it in Netra
A demo on the frameworks that matter to you.
