How to run third-party vendor risk management in a small company

What are the steps to run vendor risk management?

The same ten steps work for a 20-person company and a 1,000-person one. The order matters: you cannot tier what you have not found, and you should not review what you have not tiered.

• 1. Decide and score where you stand: an honest baseline and a business case with your own numbers.
• 2. Build the inventory from accounts payable, cards, single sign-on and contracts; keep suppliers that hold or reach data or systems, or that a critical service needs.
• 3. Tier each vendor by data, access, criticality and regulatory relevance.
• 4. Send a short or full questionnaire by tier and ask for the vendor's assurance report.
• 5. Read the report against the service you buy: scope, period, opinion, carve-outs, CUECs, exceptions.
• 6. Turn gaps into findings with owners and dates; sign risk acceptances at the right level with end dates.
• 7. Fix contracts: processing terms, breach notice in hours, audit, subprocessors, AI terms, exit.
• 8. Onboard with a checklist, monitor signals between reviews, run vendor incidents on your own clock and offboard with deletion confirmed.
• 9. Map fourth parties and concentration; check AI vendors before use.
• 10. Report to leadership each quarter, answer your own customers from a trust pack, and repeat the cycle each year.

Why does vendor risk matter for a small company?

Because accountability does not move when the work does. Canada's privacy commissioner says an organisation remains responsible for personal information it transfers to a third party for processing. The GDPR and UK GDPR expect controllers to use only processors that give sufficient guarantees, with written terms. Financial regulators go further: OSFI's Guideline B-10 expects federally regulated financial institutions to keep an inventory of third parties by risk and criticality, and the EU's DORA requires financial entities to keep a register of their ICT contracts.

Small companies feel this in two ways. Directly, through privacy law and, for some sectors, security and payments rules: Canada's Retail Payment Activities Regulations, for example, require registered payment service providers to assess their third-party service providers at least once a year and before entering, renewing, extending or substantially amending a contract. Indirectly, because banks, insurers and large customers pass their own duties down by contract. And the risk is real: Verizon's 2026 Data Breach Investigations Report found a third party involved in 48% of the breaches it analysed.

How do you build a vendor inventory?

No single system knows all your suppliers. Accounts payable misses free tools and card spend. Card statements miss invoiced suppliers. Single sign-on misses tools people log into with a password, and contracts miss anything bought without one. Pull all four, then remove spend-only suppliers (couriers, catering, office supplies) under a written rule. Keep every supplier that holds or reaches your data or systems, or that a critical service depends on, whatever it costs. Free AI add-ons count.

Give every row a business owner, then stop the list going stale with a procurement gate: no purchase order, invoice payment or card approval for a data-touching tool without an intake number. Reconcile the four sources every quarter.

How should you tier vendors by risk?

Score four factors: data (0 to 4, from none to payment or bulk customer data), access (0 to 3, from none to admin or network access), criticality (0 to 3, from easy to drop to a critical service stops) and regulatory relevance (0 to 2). Add them for an inherent score from 0 to 12. Set bands, for example 10 or more for Tier 1, 7 to 9 for Tier 2, 4 to 6 for Tier 3 and below 4 for Tier 4, and add one override: criticality 3 is always Tier 1, because a vendor can hold almost no data and still stop your service.

Here is a worked example from a fictional 180-person payments company in Toronto. The SMS gateway that sends one-time passcodes scores only 7, but if it fails nobody can log in, so the override makes it Tier 1. Across 36 in-scope vendors the company ended with 9 Tier 1, 10 Tier 2, 10 Tier 3 and 7 Tier 4; four of the nine Tier 1 vendors reached it only through the override.

What should a vendor security questionnaire ask?

As few questions as the tier needs, scored the same way every time. A short form of about 20 questions suits moderate-risk vendors; a fuller form of about 60, grouped into domains such as access, data protection, incidents, continuity, subprocessors and AI, suits high and critical vendors. Weight each question, give half marks for Partial, and drop Not applicable from the total.

Name a few knockout questions that no score can outweigh: MFA on every account that can reach your data, processing only on your instructions, encryption in transit, incident notice in a stated number of hours, and no training of shared AI models on your data. In the worked example a data warehouse vendor scored 86%, above an 80% pass mark, but its support administrators were exempt from MFA. The knockout became a High finding with a fix date, and the decision stayed pending. Where a vendor has a current SOC 2 report or a standard questionnaire such as the Cloud Security Alliance's CAIQ, let it answer what it covers.

How do you read a vendor's SOC 2 report or ISO certificate?

Read a SOC 2 report against the service you buy, in this order: the opinion and period; the system description, to check your product and region are in scope; subservice organisations and whether they are carved out; the complementary user entity controls (CUECs) you must run yourself; and the test results, searching for exceptions. If the period ended months ago, ask for a bridge letter from the vendor's management. Twenty minutes is enough for most reports.

For an ISO/IEC 27001 certificate, find it on IAF CertSearch or the certification body's register, read the scope statement word by word, check the dates and edition, and ask for the Statement of Applicability. A certificate shows a certified management system, not a test of every control. When a vendor has neither, use the full questionnaire, ask for a recent penetration test summary and record the lack of independent assurance as a finding.

What should vendor contracts include?

Processing terms wherever a vendor processes personal data for you. For high and critical vendors, add a security schedule, incident notice within a stated number of hours including subprocessors, a yearly assurance report with an audit right on cause, subprocessor notice with a right to object, named data locations, continuity commitments, AI no-training terms where relevant, and exit help with data return and deletion confirmed in writing. Financial-sector customers will ask for more under rules such as DORA, OSFI B-10 and APRA CPS 230.

You rarely fix every contract at once. Mark each clause Yes, Partial or No, fix missing processing terms immediately, and amend the rest at renewal. In the worked example, average coverage across 19 high and critical contracts was 73%, with exit and transition help the weakest clause at 11% and breach notice within 48 hours at 53%. Your counsel turns positions into contract language.

What are fourth parties and concentration risk?

A fourth party is your vendor's own vendor: its cloud host, model provider or SMS carrier. Hold the subprocessor list for every high and critical vendor, read change notices within the notice period and log which fourth parties receive your data. Then count how many of your critical services depend on each shared provider. In the worked example, one cloud provider sat under six of 19 high and critical services; a two-hour regional outage hit four of them at once.

Concentration is often unavoidable. The aim is to know it, ask vendors about regions and failover, test your own failover and make sure leadership has decided about the rest. For AI vendors, ask four extra questions before use: is your data used to train shared models, how long are inputs kept, which model providers receive it, and can a person review or override outputs.

What are the most common vendor risk mistakes?

• Sending every vendor the same long questionnaire instead of tiering first.
• Building the inventory from contracts only, missing card spend, free tools and AI add-ons.
• Reading the opinion of a SOC 2 report and stopping, without checking scope, exceptions or CUECs.
• Treating a questionnaire score as the decision when a knockout answer says otherwise.
• Accepting risk with no end date, or at the wrong level.
• Accepting contracts that promise incident notice 'promptly' instead of in hours.
• Ignoring fourth parties and concentration because they cannot be removed.
• Having no exit plan until a critical vendor fails.
• Offboarding without written confirmation that your data was deleted.
• Answering your own customers' questionnaires from memory instead of a checked answer bank.

How do you keep a vendor risk programme running?

After the first twelve weeks, it becomes a calendar: a monthly hour on the monitoring log and evidence register; a quarterly leadership report, inventory reconciliation and shadow IT sweep; and yearly re-reviews by tier, a policy review, an exit plan paper test, a vendor breach tabletop and a concentration review. Brief the people who buy tools once a year: the intake rule is only as good as their habits.

If you want to measure your team's vendor review judgement, AssessAll's Third-Party and Vendor Assurance Assessment is built for procurement, security and risk teams. To make the monthly and quarterly steps stick, Jobulary's guide to if-then plans at work is a practical method. The Third-Party and Vendor Security Risk Kit from Bodhih Training holds the workbook, questionnaires, forms and templates for every step above.