Most mid-market security teams don't fail at managing vendor risks because they skip the work. They fail because they send the same 300-question spreadsheet to the office-supplies company and the payroll processor, then run out of time before anyone reads the answers that matter. This guide to vendor risk assessment shows how to perform a vendor risk assessment that scales to a team of two: tier your vendors, match the evidence to the tier, read an assurance report the way an auditor would, and make a documented decision on every gap. It's written for the CIO, CISO or IT director at a 50–500 person regulated company who needs a defensible program for compliance, not a bigger spreadsheet. It ends with a vendor risk assessment checklist you can use this quarter, plus vendor risk assessment best practices for deciding when to bring in outside help.
Vendor audit vs vendor risk assessment: what's the difference?
A vendor risk assessment is the process of identifying, measuring and deciding what to do about vendor risks before and during a vendor relationship. It looks at the whole picture: security, privacy, financial stability, business continuity and regulatory exposure. Its output is a decision (approve, approve with conditions or reject) backed by a risk score. Some teams call it a third-party vendor risk assessment or a third-party risk assessment; the method is the same.
A vendor audit is narrower and more forensic. It tests whether a vendor actually does what its contract, questionnaire answers or certifications say it does, usually through evidence review, interviews or an onsite visit. Think of the vendor assessment as triage and the forensic review as the deep examination you reserve for the vendors where a wrong answer would hurt most.
In practice the two run together whenever you conduct a vendor risk assessment. A structured vendor risk assessment tells you which vendors need that level of scrutiny, and what the deeper review finds feeds back into the vendor’s risk profile. If your current process treats every vendor the same way, you're over-reviewing some vendors and barely looking at others.
Why is vendor risk assessment important for regulated companies?
Because attackers have figured out that your vendors are often the easier way in. Verizon's 2025 Data Breach Investigations Report found that third-party involvement in breaches doubled to 30% in a single year. A data breach at a vendor that holds your customer records is still your problem in the eyes of customers, regulators and the press. The risks associated with third-party vendors have become yours by contract.
Regulators have tightened expectations around vendor risks to match. Banks follow the Interagency Guidance on Third-Party Relationships issued by the Federal Reserve, FDIC and OCC in 2023, which covers every stage of the relationship. The SEC's amended Regulation S-P requires broker-dealers, investment advisers and other covered institutions to oversee service providers, who must report a breach within 72 hours; smaller firms had to comply by June 3, 2026. Healthcare organizations need a business associate agreement with any vendor handling PHI, and defense contractors flow CMMC requirements down to their subcontractors.
The common thread across these regulatory requirements is evidence. Regulators and auditors don't just ask whether you have vendors under control; they ask you to show how you decided. A vendor risk assessment helps organizations produce that record, and it gives leadership a clear view of third-party risks before they turn into incidents.
What are the different types of vendor risks?
Third-party risks don't all look alike, and the vendor risks you assess should match what the vendor actually does for you. Cybersecurity vendor risks come first for most regulated companies: does the vendor store, process or reach sensitive data, and what security controls protect it? A security risk at a vendor with network access is effectively a risk inside your perimeter. Operational risk is next: if this vendor went down for a week, which of your processes would stop?
Compliance vendor risks cover whether the vendor helps or hurts your compliance requirements, for example a cloud provider hosting regulated data outside approved regions. Financial risk asks whether the vendor will still exist in two years; a vendor with weak financial stability can take your data and your operations down with it. Reputational risk covers vendors whose conduct, or whose security failure, would end up in a headline next to your name.
Supply chain and concentration risk round it out. Fourth parties, the third parties your vendors rely on, carry real vendor risks you rarely see directly. And if several critical services all run on one cloud provider, a single outage becomes several. A good assessment names each specific risk rather than lumping everything under "security."
Step 1: Tier vendors by data access and business impact
The fastest way to assess vendor risk with a small team is to stop treating every vendor the same. Start with a complete vendor list, pulled from accounts payable and vendor management records rather than from IT's memory. Most companies find more vendors in the payables data than in any security inventory. Then rate each vendor on two questions: what data can they reach, and what breaks if they fail?
Use three tiers. Tier 1 vendors have access to sensitive data or run a critical process: your payroll provider, EHR or core banking platform, managed IT provider, or cloud host. Tier 2 vendors touch internal data or support important but recoverable processes. Tier 3 vendors have no data access and low business impact, such as catering or office supplies. Each risk tier sets the depth of review, so the level of risk drives the effort.
Expect Tier 1 to be a small fraction of the total. That's the point. The vendor risks that cause real damage concentrate in a handful of relationships, and tiering is what lets a small team put its time there. Every new vendor gets tiered at intake by security and compliance together, before a contract is signed, so vendor selection and vendor due diligence happen at the same time.
Step 2: Match the evidence to the tier (SOC 2, questionnaire, onsite)
Evidence should scale with the vendor risks in play. For Tier 1, the vendor security evidence should include a current SOC 2 Type 2 report or ISO 27001 certificate, a full security questionnaire such as the SIG or CSA CAIQ, the vendor's incident response plan summary, proof of cyber insurance and, for the most critical, an onsite or virtual security assessment. For Tier 2, a SOC 2 report or a shorter questionnaire is usually enough. For Tier 3, a brief attestation and standard contract terms will do.
Don't send a questionnaire when better evidence exists. A vendor with an independent attestation report has already answered most of your questions under an auditor's scrutiny; ask only about the gaps the report doesn't cover, such as newer security practices around AI tools. That shortens the vendor risk assessment process for both sides and keeps vendors cooperative.
Use one standardized vendor risk assessment template per tier so answers are comparable across vendors. A template that matches the tier also keeps assessors from inventing new questions each time, which is how programs lose consistency.
Step 3: What to check in a vendor's SOC 2 report
An effective vendor risk assessment reads the evidence instead of just collecting it. Start with the basics: is it a Type 2 report, covering how controls operated over a period (ideally 12 months), or a Type 1, which only covers design at a point in time? Check the dates. If the period ended more than a few months ago, ask for a bridge letter. Then read the system description and confirm the service you buy is actually in scope.
Next, read the exceptions. The tests-of-controls section lists where the auditor found controls didn't operate as described. A few minor exceptions are normal; exceptions in access management, change management or incident response deserve follow-up questions, because those are the vendor risks that become incidents. Check whether the opinion is qualified, and look at subservice organizations: if the vendor carves out its cloud host, you need that provider's report too.
Two more checks most teams skip. Complementary user entity controls list what you must do for the vendor's controls to work, such as managing your own user access, so treat them as your obligations. And look at who signed the report. The AICPA has posted a notice that it is looking into allegations about the business practices of a compliance vendor that offers SOC services. An unfamiliar CPA firm is a reason to ask questions, not an automatic rejection.
Step 4: Score, remediate or formally accept the risk
Turn the vendor risks you found into a risk score. A simple likelihood-times-impact scale from 1 to 5 works for most mid-market programs; in any vendor risk assessment framework, the scoring method matters less than applying it the same way every time. Compare each risk level against your documented risk tolerance, set by leadership rather than by the assessor.
Every finding then gets one of three outcomes. Remediate: the vendor fixes the gap by an agreed date, written into the contract where possible to ensure compliance. Mitigate: you add your own control, such as limiting what data the vendor receives or requiring MFA on their access. Accept: a named business owner signs off on the residual risk, with an expiry date. Risk mitigation that lives only in an email thread doesn't count.
Formal acceptance is the step most programs skip, and it's the one auditors look for. An exceptions register showing who accepted which vendor risks, why and until when turns a judgment call into a defensible decision.
How often should you reassess vendors?
Vendor risks change, so reassessment frequency should follow the tier. A sensible cadence is to conduct vendor risk assessments on Tier 1 vendors every year, plus continuous monitoring; Tier 2 every two years; Tier 3 at contract renewal. That cadence keeps a robust vendor risk assessment program running without burying the team.
Some events should trigger a review immediately: a security incident at the vendor, an acquisition, a big change in what data they handle, or a new compliance obligation. Continuous monitoring fills the gap between reviews. Security ratings, breach news alerts and checks for leaked vendor credentials, the same signals behind dark web monitoring, can flag a high-risk vendor change long before the next scheduled assessment.
Track reassessment dates the same way you track contract renewals. If a review lapses, the vendor's tier and access should be revisited, not quietly carried forward.
Vendor audit checklist
Use this checklist to document vendor risks the same way on every review, and trim it for lower tiers:
- Tiering: data access, business impact and risk tier recorded, with a named business owner.
- Security evidence: current SOC 2 Type 2 or ISO 27001, scope confirmed, exceptions reviewed, bridge letter if needed.
- Security questionnaire: completed for gaps the report doesn't cover; answers on encryption, access control and data handling practices verified.
- Incident response: breach notification timeline in the contract, aligned to your own regulatory clocks.
- Business continuity: tested continuity and disaster recovery plans for Tier 1 vendors.
- Subprocessors: fourth parties listed, with notice required before changes.
- Regulatory compliance: BAA, data processing terms or flow-down clauses in place where required.
- Financial and insurance: financial health check and cyber insurance certificate for critical vendors.
- Decision: score, remediation plan or signed risk acceptance, plus the next review date.
Keep the completed vendor risk assessment checklist with the contract file. When an auditor or regulator asks why a vendor was approved, the answer should be one document away.
Run it in-house or use a TPRM service?
A two-person security team can run a vendor risk management program for 50–100 vendors in-house with a spreadsheet, a questionnaire library and discipline. Past that, or when Tier 1 reviews take weeks each, the volume of vendor risks outruns two people. Third-party risk management software helps you manage vendor intake, questionnaires and reminders; a managed service adds analysts who actually read the reports and chase vendors for answers.
The choice depends on where your bottleneck is. If you have the expertise but not the hours, tooling helps. If nobody on staff can read an attestation report's exception list with confidence, you need people. Managed services help organizations that have the policy but not the analysts. We compare both routes in TPRM software vs managed TPRM services, and our guide to third-party risk management services covers what a good provider should deliver.
Either way, look at the size of your vendor ecosystem itself. Fewer vendors means fewer assessments, which is why many mid-market teams pair their TPRM program with cybersecurity vendor consolidation.
Frequently asked questions
What is a vendor risk assessment?
The process of identifying, measuring and deciding what to do about the risks a vendor brings, before and during the relationship. It ends in a documented decision: approve, approve with conditions or reject.
What is the difference between a vendor audit and a vendor risk assessment?
A risk assessment decides what to do about a vendor across security, privacy, financial and continuity risk. A vendor audit is narrower: it tests whether the vendor actually does what its contract, questionnaire answers or certifications say.
How often should vendors be reassessed?
A common cadence is yearly for Tier 1 vendors with continuous monitoring, every two years for Tier 2, and at contract renewal for Tier 3. Incidents, acquisitions or changes in data access should trigger an immediate review.
What should you check in a vendor's SOC 2 report?
Confirm it is a Type 2 report with a recent period and that the service you buy is in scope, then review the exceptions, any qualified opinion, carved-out subservice organizations, complementary user entity controls and the CPA firm that signed it.
What should a vendor risk assessment checklist include?
Tiering, security evidence, a questionnaire for gaps, breach notification terms, business continuity, subprocessors, regulatory clauses such as a BAA, financial and insurance checks, and a recorded decision with a next review date.
Need help with vendor risk assessments?
VisioneerIT runs third-party risk management programs for regulated mid-market companies, from the first tiering of your vendor risks to ongoing Tier 1 reviews, and extends that work into supply chain risk management for organizations with deeper supplier exposure. Our cybersecurity consulting team, which works across financial services and other regulated industries, can review your current process against your compliance obligations. Talk to our team about a vendor risk baseline.
Key Things to Remember
- A vendor risk assessment decides what to do about a vendor; a vendor audit verifies that the vendor does what it claims.
- Third-party involvement in breaches doubled to 30% in Verizon's 2025 DBIR, and compliance teams and regulators now expect documented vendor oversight.
- Tier vendors by data access and business impact; most of the real vendor risks sit in a small fraction of them.
- Match evidence to the tier, and don't send a questionnaire where a SOC 2 report already answers it.
- Read assurance reports for type, dates, scope, exceptions, carve-outs, user entity controls and the CPA firm.
- Every one of the vendor risks you find ends in remediation, mitigation or a signed, dated risk acceptance.
- Reassess by tier, monitor Tier 1 continuously, and keep the checklist with the contract.
