Properly managing your vendor relationships is rather important. When performing a vendor risk assessment, it's not a time to cut corners. You want to do a thorough evaluation, so you don't end up working with an unstable company or even a criminal company.

Before you start looking into how to do a vendor risk assessment, it's important to know a few things. Let's look closely at vendor risk assessments and how they can stabilize your organization.

What is a Vendor Risk Assessment?

A vendor risk assessment (VRA) may also be called a vendor risk review. It's a process used to identify and evaluate any potential risk associated with a potential vendor and the products or services they can offer your organization.

When you start the process of a third-party risk assessment, you will be able to see the potential impact of uncertain events. This can help with identifying and measuring these specific events and the potential risk they pose to your company. A third-party vendor risk assessment will look at possible financial risk, residual risks, cyber risks, security risks, and more.

When you go through the vendor risk assessment process, you will be better at making the right decision for your organization. The process of due diligence can help mitigate many risks due to a poor relationship. It will also provide the confidence you need to form a productive relationship with your new third-party vendor.

What kind of questions are on a vendor risk assessment?

When it comes to identifying risk, you need to ask the right questions. A vendor risk assessment will include a questionnaire that should ask the best questions to help you evaluate the potential risk you face with a specific third-party vendor.

In some cases, you will use a SIG questionnaire, which can be very helpful. You might be wondering what is SIG. SIG stands for Shared Assessments Standardized Information Gathering. It's a comprehensive set of questions that will cover 18 risk domains and can be very helpful when performing a risk assessment.

The questions found on a vendor assessment questionnaire should cover the following areas:

  • References—Make sure you ask about references and get a few names with contact information.
  • Financial Statement—You want to make sure you get recent financial statements to assess the financial risk of a vendor.
  • Performance—Find out about on-time delivery, contract stipulations, communication process, and documentation you will provide.
  • Compliance—You need to make sure any vendor you plan to use has good compliance with up-to-date liability insurance, licensing, regulatory compliance, and more.
  • Background Checks—It's also a good idea to obtain a background check and a criminal check including any history of lawsuits and complaints with the Better Business Bureau and state attorney general.
  • Security Processes—Data security is rather important and you want to ask about how the vendor handles any type of security breach as a part of assessing the cyber risk of the vendor.
  • Cyberthreat Governance—It's important to know who's responsible for cybersecurity and physical security within the organization.
  • Technology—You will also want to find out what type of technology is being used, especially when it comes to data security and cybersecurity.

There are many questions to consider when doing a vendor risk assessment. Make sure your questionnaire includes all the necessary questions to cover compliance, information security, and all the categories listed above.

Who determines the questions on the assessment?

Your organization should certainly have at least some say in the questions asked when handling a vendor risk assessment. However, you might hire a third-party service provider to create your questionnaire or even handle the vendor assessment.

Sometimes, a third-party risk management company will have the right best practices in place to make handling vendor risk management easier for you. It's still important to ensure all the right questions are being asked to properly assess your organization's risk.

When you want to learn how to manage third-party risk, having control over the questions used to determine risk is important. You can start with a SIG questionnaire and make adjustments to fit your specific needs.

Different Types of Vendor Risk Assessments

Vendor risk management is not a one-size-fits-all thing There are different types of vendor assessments your organization can use. Some vendor risk management programs will use vendor risk management software to make it easier. Others have specific best practices in place to streamline the process.

The types of risk assessments you might encounter include:

1. Qualitative Risk Assessment

This is the most common form of risk assessment used by an organization when evaluating a supplier or another vendor. You will likely find this type of risk assessment in the workplace for injury risk assessment. It's based on the expertise of the assessor.

Using this type of risk assessment is common to figure out the inherent risk of someone getting injured. A qualitative risk assessment scores the risk level as high, medium, or low. No numbers will be involved, but the inherent risk is still calculated.

2. Quantitative Risk Assessment

Another form of risk assessment, a quantitative risk assessment will use a numerical value to assess the risk. Instead of a high, medium, or low risk, it will likely be a number scale.

Often, this form of assessment is used by an organization when evaluating third-party risk with a major hazard, such as a nuclear plant or a complex chemical plant.

It's common for a quantitative risk assessment to use a risk matrix to assign numbers to the severity and likelihood of the risk.

3. Generic Risk Assessment

Another common type of risk assessment used in risk management is the generic risk assessment. This type of assessment will look at the general activity being done or it can look at a specific service provider to assess the risk. Its generic status allows it to fit various risk management needs.

How do I perform the risk assessment?

Creating a system to assess the risk of a supplier or any type of vendor is important. You want to have a vendor risk management program that makes it easy for you to determine the risk of any vendor you plan to work with. Here are a few simple steps to follow when performing a risk assessment.

Step #1—Identify the Types of Vendor Risks

Before performing the evaluation, it's important to know the different vendor risks you might face. These include:

  • Financial risk
  • Strategy risk
  • Geographic risk
  • Compliance risk
  • Sub-sequential risk
  • Replacement risk
  • Technical risk
  • Operational risk
  • Resource risk
  • Reputational risk

The last thing you need is to hire a vendor that causes reputational damage to your company or puts you at any other type of risk. Risk management starts with identifying risks you could face.

Step #2—Determine Your Risk Criteria

While knowing the different categories of risk is important, not all risk categories will apply to you or to every supplier you work with. It's important to determine your risk criteria, based on the risks you're most concerned with. For example, you might place a higher value on information security, while someone else might be most worried about the financial risk.

Step #3—Assess the Vendors/Hire Help

You can take on the task of risk management on your own or you can hire a third-party risk management company to help you. Either way, you want to assess all possible vendors and the services and products they provide.

Separate the vendors by risk level and create a third-party risk management plan. Make sure you remain up-to-date on regulations as they change to ensure your vendors remain at the same risk level.

It's smart to conduct annual assessments as the risk of a vendor can change over time. Make sure you are doing regular supplier risk assessments and using your organization's best practices for risk management.

How can RiskRecon help me?

When you need the help of a third-party risk management firm, RiskRecon, a Mastercard Company is the right choice for you. We provide many different solutions to assess cybersecurity risks in every step of the process. Start with a RiskRecon demo today and find out more about how we can help you with vendor risk management.