Guide · 8 min read
Vendor risk without the spreadsheet chaos
A practical approach to third-party risk management: tiering vendors by inherent risk, reading SOC 2 Type II reports, CUECs and bridge letters, contract clauses and ongoing monitoring.
Third-party risk programmes often drown in their own paperwork. Every supplier gets the same 300-question spreadsheet, the answers go into a shared drive, and nobody can say which vendors actually matter. The fix is not a bigger questionnaire. It is doing less, in the right places.
Tier before you assess
Start every new vendor with four simple questions: what data will they handle, what access will they have, how critical is the service, and how much data is involved. The answers give you a tier, and the tier decides how much work follows:
- Tier 1 (customer or sensitive data, critical service): full questionnaire, SOC 2 Type II or equivalent, contract security schedule, senior approval, annual review.
- Tier 2: shorter questionnaire, independent report if available, review every two years.
- Tier 3 (no data, easy to replace): a light check and business-owner approval.
Watch for pressure to tier a vendor down because "the business needs it live this month". That is exactly the vendor that needs the checks.
Read the SOC 2 report, not just the opinion
A clean opinion on page three doesn't mean there is nothing to see. Check:
- Type and period: Type II tests operation over months; Type I is a point in time.
- Scope: is the service you are buying actually in it?
- Exceptions: late leaver removals or unapproved changes may affect your data directly.
- CUECs: the controls the vendor expects you to run, such as reviewing your users on their platform. Give each one an owner.
- The gap: if the period ended months ago, ask for a bridge letter.
The contract is your lever later
Once signed, you can only insist on what the contract says. For anything Tier 1, make sure you have a right to audit (or annual independent reports), a fixed breach-notification window, control over subprocessors, deletion of your data at exit with a certificate, and a security schedule that commits the vendor to fix the findings you raised.
Approval should match the risk
A Tier 1 vendor with open findings shouldn't be approved by the business owner over email. Route it to whoever can accept that level of risk, and write the remediation you are relying on into the approval as conditions.
Keep watching, then leave cleanly
Approval is a snapshot. Set the review frequency by tier, act on signals between reviews (a breach at the vendor's subprocessor, for example), and when a contract ends, remove accounts and tokens and get evidence your data was destroyed.
One good vendor file for each Tier 1 supplier will impress an auditor far more than hundreds of half-read questionnaires.