How to Perform a Vendor Risk Assessment
Performing a vendor risk assessment is the process of evaluating a third-party vendor's risk profile and determining the appropriate level of oversight. This guide walks through the steps to conduct a comprehensive, risk-based assessment that produces actionable results.
Step 1: Gather Vendor Information
Before assessing risk, gather all relevant information about the vendor: services provided, data access level, contract value, criticality to your operations, and any previous assessment results. If this is a new vendor, send a due diligence questionnaire (DDQ) to gather the information. If this is an existing vendor, pull the existing risk profile and update it with any changes.
Step 2: Score Inherent Risk
Assess inherent risk — the risk before any controls — across multiple dimensions: financial (vendor's financial stability), operational (service delivery capability), compliance (regulatory standing), cyber (security posture), and reputational (vendor's reputation). Score each dimension for impact (1-5) and likelihood (1-5). The product gives an inherent risk score for each dimension and overall.
Step 3: Evaluate Controls
Document the controls the vendor has in place to mitigate each risk dimension. Controls may include: certifications (ISO 27001, SOC 2), policies and procedures, monitoring systems, incident response plans, and business continuity plans. Rate the effectiveness of each control — fully effective, partially effective, or ineffective — based on evidence from the DDQ, audits, or assessments.
Step 4: Calculate Residual Risk
Residual risk is the remaining risk after controls. Calculate it by adjusting inherent risk based on control effectiveness. If controls are fully effective, residual risk is significantly lower. If controls are partially effective or ineffective, residual risk remains close to inherent risk. Compare residual risk to your organization's risk appetite to determine if the risk is acceptable.
Step 5: Classify the Risk Tier
Based on the residual risk score, classify the vendor into a risk tier: high, medium, or low. The risk tier determines the level of ongoing oversight — high-risk vendors receive enhanced due diligence, more frequent assessments, and closer monitoring; low-risk vendors receive lighter-touch oversight. Document the classification rationale.
Step 6: Define Treatment Plans
For risks where residual risk exceeds your risk appetite, define treatment plans: additional controls to implement (with the vendor or internally), risk transfer (insurance), risk avoidance (exit the relationship), or risk acceptance (document the decision with approval). Each treatment plan should have an owner, target date, and target residual risk level.
Step 7: Document and Communicate
Document the full assessment — inherent risk, controls, residual risk, risk tier, and treatment plans — in a formal risk assessment report. Communicate the results to stakeholders: the vendor relationship owner, risk function, and senior management if the risk is material. The assessment should be linked to the vendor record and the risk register for full audit trails.
Key Takeaways
- Start by gathering comprehensive vendor information through DDQs or existing profiles
- Score inherent risk across financial, operational, compliance, cyber, and reputational dimensions
- Evaluate controls and calculate residual risk — compare to your risk appetite
- Classify into a risk tier that drives the level of ongoing oversight
- Define treatment plans for risks above your risk appetite
- Document everything with full audit trails and communicate to stakeholders
Frequently Asked Questions
How long should a vendor risk assessment take?
For a new vendor, the assessment typically takes 2-4 weeks including DDQ distribution and response evaluation. For an existing vendor with previous assessments, it can be completed in days using pre-population and answer library features. MPG's automation significantly reduces the time required.
What if the vendor refuses to provide information?
Contractual rights to information should be established during onboarding. If a vendor refuses, escalate through the relationship manager, cite contractual audit rights, and consider whether the risk is acceptable without the information. If not, the relationship may need to be terminated. MPG's assessment workflows include escalation paths for non-responsive vendors.