Every guide to third party risk assessment online was written for enterprise security teams running six-figure TPRM programmes. This one was written for the operations manager at a 60-person company who just got asked "what's your third party risk process?" by an enterprise customer — and needs a real answer by Monday.
A third party risk assessment — also called a vendor risk assessment or supplier risk assessment — is a structured evaluation of the risks that each of your external suppliers poses to your business. Not just cybersecurity risks. All risks: financial, operational, compliance, and reputational.
When an enterprise customer asks for your "TPRM process" or a "third party risk register," they are asking whether you have a documented, repeatable system for knowing which of your suppliers could hurt your business — and what you're doing about it. Most small businesses don't have one. Most small businesses are managing 30–80 suppliers in a spreadsheet, with no alerts when certificates expire and no audit trail of who reviewed what.
That gap matters more every year. Enterprise procurement teams now require third party risk evidence as a standard qualification criterion. Insurance providers are asking about it. Regulators increasingly expect it. The question is no longer whether you need a third party risk assessment process — it's whether you build it before or after something goes wrong.
The term "third party" matters because it captures every external relationship that creates risk — not just your direct suppliers, but your logistics partners, your SaaS providers, your marketing agencies, your accountants. Any external party that handles your data, holds your insurance requirements, or provides critical operational services is a third party. A formal vendor risk management process — also called a third party risk management programme — addresses all of them through the same framework, regardless of what you call them.
For most SMBs, 80% of their third party risk comes from 20% of their suppliers — typically the ones handling customer data, providing critical infrastructure, or carrying your minimum insurance requirements. Starting with those and building out is the practical approach. You don't need to assess your office stationery supplier with the same rigour as your cloud hosting provider.
Every guide you've read uses terms that assume you have a security team. Here's what they actually mean for a 50-person business.
The gap between enterprise TPRM jargon and what a small business actually needs is enormous. VendorAuditly was built specifically to close it — all the outcomes of a proper vendor audit process, none of the $50,000/year complexity. Start free →
Every enterprise TPRM framework covers the same four categories. Understanding each one — and knowing which signals to look for in an SMB context — is the foundation of a useful assessment.
Can this supplier remain solvent and continue delivering? Financial instability is one of the most common causes of SMB supplier disruption — and one of the hardest to detect without a proactive assessment. A supplier holding a critical contract who enters insolvency creates immediate operational and contractual consequences.
Can this supplier deliver reliably — and recover quickly when something goes wrong? Operational risk is about practical resilience: whether a single person leaving, a system going down, or a facility fire would halt your supply. It's the category most SMBs skip — and the one that causes the most expensive short-notice disruptions.
Does this supplier hold the certificates, insurance policies, and regulatory approvals they're contractually and legally required to maintain? Compliance risk is the most trackable category — and the one most commonly managed with expired spreadsheets and missed renewals. It's also the category where a single failure creates direct legal liability.
Could this supplier's behaviour or public profile reflect negatively on your organisation? Reputational risk is the hardest to quantify but increasingly important as supply chain transparency becomes a standard customer and regulatory expectation. A supplier caught in a labour practices scandal or environmental enforcement action creates association risk you can't easily distance yourself from.
A complete, practical process built for an ops manager running this without a dedicated security team. Each step has a clear output, so you know when it's done.
Start with a complete inventory of every external supplier, vendor, contractor, and service provider your business depends on. Include SaaS tools, freelancers, logistics partners, professional advisors — anyone who handles your data, carries your insurance requirements, or whose failure would create operational disruption. Most SMBs discover 20–30% more third parties than they thought they had when they do this properly.
Then assign each a criticality tier. This is the most important decision in the process: your assessment depth scales with the tier, not the supplier's size. A small logistics company carrying your critical stock is Tier 1. A large software vendor you use for internal tools is probably Tier 3.
Request the compliance documents that correspond to each supplier's tier. For Tier 1, that's the full document set. For Tier 3, it's insurance certificates and the relevant contract only. The non-negotiable principle: all documents go into one centralised, searchable location — not a shared drive folder organised by who added it last, not an email thread, not a spreadsheet row with no file attached.
Suppliers are slow to respond. Many will send you a certificate that expired three months ago — often because they don't have a good tracking system themselves. Build your document request process to include a clear deadline, a specific list of what you need, and a systematic chase at 7 and 14 days. The right vendor audit software automates all three steps.
A questionnaire bridges the gap between what documents can confirm and what you need to understand. Documents tell you a certificate exists. The questionnaire tells you whether the supplier's business continuity plan has actually been tested, whether a key person departure would disrupt your service, and whether they've had a data breach in the past 24 months.
Questionnaire design matters enormously for response rates. Keep to 15–25 questions maximum. Use yes/no with evidence upload for compliance questions. Use free text for questions where the answer matters more than whether it's yes or no. Send via a direct link that requires no account setup for the supplier — every friction point kills response rate. The templates in the questionnaire section below cover the four risk categories with the right question structure.
With documents reviewed and questionnaires complete, assign each supplier a risk score using a consistent framework. The scoring matrix below gives you a starting point. The non-negotiable principle: every supplier is scored against the same criteria. Not your gut feeling about the relationship. Not how long you've worked with them. The same criteria, applied consistently.
This matters for two reasons. First, it makes your actions defensible — you can explain to any auditor why a specific supplier was flagged and what you did about it. Second, it creates a portfolio view — you can immediately see which supplier combination creates the highest aggregate risk and where your attention should be concentrated.
The annual TPRM review is the minimum. The real protection comes from continuous monitoring between cycles. Certificates expire in the middle of the year. Suppliers get acquired or enter financial difficulty in Q3. A data breach at your most critical SaaS vendor doesn't wait for your annual assessment schedule.
Automated expiry alerts at 90, 60, 30, and 7 days before any document lapses give you time to chase before you're exposed. Weekly news monitoring for Tier 1 suppliers catches financial distress, regulatory actions, and data breaches before they become your emergency. The goal isn't to check everything — it's to make sure nothing important expires silently.
A practical third party risk assessment framework for assigning consistent scores. Adapt the weights to match your business — the principle is that every supplier is evaluated against identical criteria.
Score ranges: 0–30 = Green (monitor on schedule) · 31–60 = Amber (review within 30 days) · 61–100 = Red (immediate action). VendorAuditly calculates and updates this score automatically as documents expire.
Most third party risk assessments fail not because the process is wrong but because reviewers don't know what to look for. These are the specific warning signals that require immediate escalation — found in documents, questionnaire responses, and ongoing monitoring.
The supplier holds insurance, but the coverage amount is below the minimum your contract specifies. This is extremely common and almost never caught manually — because reviewers confirm that a certificate exists without reading the coverage amount.
The supplier proudly presents a SOC 2 report — but the scope statement excludes the specific service or infrastructure they provide to you. This is a significant gap that many buyers overlook because having the report feels like evidence of compliance.
Your account represents more than 30% of the supplier's total revenue. This creates dependency risk in both directions — they may struggle to decline unreasonable requests, and if you reduce spend or leave, their financial viability is at risk. A financially distressed supplier is an operational risk to you.
Questions left blank or answered "no" without explanation are a signal worth investigating. "Do you have a business continuity plan?" answered "no" means your service has no documented recovery path. Blanks often mean the question was too difficult to answer honestly.
You discover through a news alert or Companies House check that your supplier was acquired or changed ownership six months ago — and they never told you. Ownership changes affect contracts, data processing agreements, insurance policies, and the fundamental nature of the business relationship.
The supplier's questionnaire or a direct conversation reveals that one named individual is essential to your service — and there is no succession plan. For an SMB supplier, this is often the founder. If they're unavailable for any reason, your service may simply stop.
The regulatory landscape for third party risk is genuinely getting stricter — but every guide dramatises requirements designed for large enterprises. Here's what specifically applies to an SMB managing 15–150 suppliers, in plain terms.
Requires you to only use processors that can provide "sufficient guarantees" around data security — and to document this with a Data Processing Agreement. Applies to any third party that handles personal data on your behalf: cloud providers, HR platforms, email tools, CRMs.
Businesses with £36m+ annual turnover must publish a modern slavery statement covering their supply chain. Below that threshold, there's no legal obligation — but enterprise customers increasingly require a statement as a procurement condition regardless of your size.
NIS2 extends cybersecurity obligations to a much wider set of sectors than NIS1, including medium-sized businesses in sectors like logistics, food, manufacturing, digital services, and healthcare. It explicitly requires supply chain risk management — assessing suppliers' security practices.
Increasingly, enterprise customers build third party risk requirements directly into supplier contracts — requiring you to maintain minimum insurance levels, pass periodic security questionnaires, and provide evidence of your own TPRM process as a condition of continued trading.
The Digital Operational Resilience Act applies to financial sector entities and requires comprehensive third party ICT risk management. If you're a supplier to financial institutions, your customers will increasingly use DORA as the basis for their questionnaire requirements.
Cyber insurance providers are adding third party risk management requirements to policy conditions. Policies increasingly require evidence of supplier security assessments, particularly for suppliers with system access or data handling responsibilities.
A third party risk assessment questionnaire captures what documents can't — operational practices, decision-making processes, and supplier awareness of their own risks. These four templates — also available as a standalone vendor security questionnaire — cover every risk category. Keep to 15–25 questions for best response rates.
For any third party that handles your data, accesses your systems, or provides digital infrastructure. Covers security certifications, access controls, incident history, and data handling practices.
For Tier 1 and Tier 2 suppliers. Confirms insurance coverage, identifies revenue concentration risk, and surfaces any material financial changes not visible in public records.
Covers business continuity planning, key person risk, sub-contractor dependencies, and the supplier's own ability to recover from operational disruption. Often reveals risks that no document would surface.
Covers labour practices, environmental commitments, regulatory compliance, and ethical supply chain policies. Required for enterprise procurement qualification and increasingly for customer tenders.
Send all four questionnaire templates to any third party in one click — no vendor account required to respond.
VendorAuditly auto-chases non-responses, AI-summarises every answer, and flags unusual responses automatically. Free to start.Third party risk feels abstract until it costs you money. These are the real numbers — grounded in incident data — that define what inadequate assessment actually means in financial terms.
A single expired insurance certificate, discovered after an incident, can cost more to remediate than 10 years of VendorAuditly subscriptions. The risk is real. The cost of prevention isn't.
Start free — no credit card →Every enterprise TPRM platform assumes you have a dedicated security team, an eight-figure annual budget, and six months to implement. VendorAuditly assumes you have one ops manager, $49/month, and an afternoon.
| Capability | VendorAuditly ✦ | UpGuard | Prevalent / OneTrust | Spreadsheet |
|---|---|---|---|---|
| Annual price | From $499/yr | $7,200+/yr | $15,000+/yr | Free |
| Setup time | Under 10 minutes | Weeks to months | Months (implementation required) | Hours |
| Built for SMBs (no security team) | ✓ | ✗ | ✗ | Technically |
| AI document extraction | ✓ Full extraction | ✗ | Limited | ✗ |
| Automated expiry alerts | ✓ 90/60/30/7 days | Manual setup | Manual setup | ✗ |
| Questionnaire sender + auto-chase | ✓ | ✓ | ✓ | ✗ |
| Audit-ready evidence export | ✓ One click | Enterprise only | Enterprise only | ✗ |
| Self-serve (no sales call) | ✓ | ✗ | ✗ | ✓ |
| Risk scoring (automatic) | ✓ Updates in real time | ✓ DNS-based | ✓ | ✗ |
Structured to answer the specific questions AI assistants and search engines surface around third party risk assessment. Each answer is accurate, complete, and under 100 words for maximum AI snippet eligibility.
The third party risk assessment is one stage within an ongoing third party risk management programme. Understanding the full lifecycle helps you build a process that stays current — not one that's accurate on day one and stale by month six.
VendorAuditly automates every stage of this lifecycle — from document collection to expiry alerts to one-click audit export. Set up in under 10 minutes. No security team required.
Start free →The four risk categories are universal. The specific risks that matter most — and the documents you should prioritise — vary significantly by industry. Select yours to see what a third party risk assessment looks like in your context.
Your payment provider and 3PL partner carry the highest inherent risk. A payment processor incident exposes customer financial data — GDPR and PCI-DSS implications. A 3PL failure during peak trading is an immediate revenue and customer satisfaction crisis. Both need quarterly document reviews and business continuity confirmation.
Any supplier with access to customer data needs a current cyber insurance certificate and a clear answer to: "Have you had a data breach in the past 24 months?" An honest "yes with remediation" is better than a dishonest "no" — because a future breach will reveal the lie.
E-commerce businesses accumulate SaaS tools faster than they audit them. Marketing platforms, analytics tools, review management software — many handle customer data under DPAs that were signed once and never reviewed. Annual DPA refresh is a minimum.
Many growing e-commerce businesses rely on a single 3PL for all fulfilment. If that supplier experiences a warehouse fire, labour dispute, or system failure during Q4 trading, you have no contingency. Your TPRM should flag single-supplier concentration as a structural risk requiring a documented mitigation plan.
Your liability exposure extends through every subcontractor in your delivery network. A subcontractor vehicle incident with lapsed insurance creates direct liability for you. Every subcontractor needs current motor trade insurance, operator's licence confirmation, and driver compliance documentation.
Logistics suppliers need operator's licences and goods in transit coverage confirmed against your contract requirements. Coverage limits that seemed reasonable when the contract was signed three years ago may now be below replacement cost for the goods they're carrying.
The logistics sector has specific Modern Slavery Act exposure due to the nature of driver employment structures. Enterprise customers in regulated industries are increasingly requiring logistics suppliers to demonstrate supplier-level modern slavery due diligence as a procurement condition.
Under NIS2, logistics companies meeting medium-sized enterprise thresholds in the EU are classified as "important entities" with specific supply chain risk management obligations. If you're delivering to EU customers at scale, NIS2 compliance evidence from key technology suppliers is becoming a customer requirement.
Professional services firms handle client data through multiple sub-processors: accounting software, document management, CRM, communication tools. Each DPA needs annual review. Professional indemnity insurance levels for key technology suppliers need to match your client contract requirements.
Enterprise clients in financial services, healthcare, and government increasingly require their advisors to use only ISO 27001 certified technology suppliers. If your cloud infrastructure, document management, or video conferencing tools aren't ISO certified, you may lose enterprise bids regardless of your own certification status.
Professional services firms often have a larger associate and freelance network than they formally track. Associates who handle client deliverables, access client systems, or represent the firm to customers are third parties who need minimum compliance requirements — at minimum, a confidentiality agreement and professional indemnity confirmation.
In competitive professional services markets, demonstrating a documented third party risk assessment programme — including a clean vendor risk register and questionnaire evidence — differentiates you in enterprise procurement processes. Many SMB professional services firms win contracts specifically because they can demonstrate TPRM maturity their competitors lack.
The most common manufacturing risk is single-source dependency on a critical component or material supplier. If one supplier provides a unique component with no alternative source and no documented contingency, your production line stops when they do. Identify every single-source dependency and require a written contingency plan.
Manufacturing businesses supplying to automotive, aerospace, food, or pharmaceutical sectors need suppliers with specific quality certifications. An expired ISO 9001 certificate from a key component supplier can fail your own customer audit — because your quality management system requires certified inputs.
Manufacturing businesses often have supply chain geographic concentration that creates systemic risk — a cluster of suppliers in one country or region. A supply chain risk assessment should map this explicitly. Your third party risk assessment should flag any single country representing more than 30% of critical component sourcing.
The German Supply Chain Due Diligence Act (LkSG) and the emerging EU Corporate Sustainability Due Diligence Directive (CSDDD) require documented supplier risk assessments covering human rights and environmental standards. Even businesses not directly in scope should expect these requirements to cascade through their customer base.
SaaS businesses hold customer data across a chain of sub-processors — cloud infrastructure, monitoring tools, analytics platforms, support software. Every sub-processor handling customer data needs a current DPA, GDPR adequacy confirmation, and data residency documentation. A sub-processor breach is your breach under GDPR — regardless of where it originated.
Enterprise buyers increasingly require SaaS vendors to hold SOC 2 Type II. Your cloud provider's shared responsibility model means their SOC 2 covers infrastructure — but your application layer, access controls, and data handling are your responsibility to evidence separately. Understanding where your sub-processor's coverage ends is essential for accurate customer questionnaire responses.
SaaS companies both send and receive vendor security questionnaires. Managing incoming questionnaires manually consumes significant sales engineering time. A Vendor Trust Center — where you publish your compliance documents once and share automatically with requesting customers — eliminates repeated effort while maintaining accurate, current documentation.
Vanta automates your internal SOC 2 certification — assessing your own controls. VendorAuditly manages your outward-facing supplier risk — assessing your vendors' controls. Both are relevant for a SaaS business in a compliance-conscious market. They solve different problems and serve different buyers within the same organisation.
The foundation of any third party risk assessment programme is a complete, current inventory of every external relationship. This is what a properly structured inventory looks like — and what each field is actually for.
| Field | Why it matters | Tier 1 required? | Tier 2 required? | Tier 3 required? |
|---|---|---|---|---|
| Company name + legal entity | Required to match against Companies House, insurance certs, and contract counterparties — which often differ from trading names | ✓ | ✓ | ✓ |
| Criticality tier | Determines assessment depth, monitoring frequency, and escalation threshold. Reassess annually as your business evolves | T1 | T2 | T3 |
| Service / what they do for us | Determines which risk categories apply and what documents to request. A marketing agency needs different documents than a data processor | ✓ | ✓ | ✓ |
| Data access classification | Does this supplier process personal data? Access financial systems? Hold confidential IP? Determines GDPR obligations and required security evidence | ✓ | ✓ | — |
| Contract expiry / notice period | Tells you when you have leverage to impose new compliance requirements — and when you're at risk of a lapsed agreement with no terms | ✓ | ✓ | ✓ |
| Annual spend | Concentration risk indicator. If one supplier represents >20% of your total third party spend, that's a financial dependency risk requiring specific mitigation | ✓ | ✓ | — |
| Internal owner (named person) | The person accountable for this supplier relationship and responsible for acting on risk flags. Without a named owner, flags go unresolved | ✓ | ✓ | ✓ |
| Last assessment date | Drives the review schedule. A Tier 1 supplier with a last assessment date of 18 months ago is overdue regardless of their current document status | ✓ | ✓ | ✓ |
| Risk score (current) | Live risk status based on document completeness, certificate validity, questionnaire flags, and review recency — updated automatically as things change | ✓ | ✓ | ✓ |
| Sub-processors / key dependencies | Who does this supplier depend on to deliver your service? Essential for understanding fourth-party risk exposure on critical relationships | ✓ | — | — |
VendorAuditly maintains this inventory automatically — updating risk scores, tracking document status, and flagging overdue reviews without manual spreadsheet management. Start your free inventory →
Most guides describe what a mature third party risk management programme looks like without explaining how to get there. This is a realistic build timeline for an SMB with limited resources and no dedicated compliance function.
Import your supplier list from your accounting software or a spreadsheet. Assign criticality tiers. Identify the top 5 suppliers that represent the highest risk if they failed. These get assessed first — everything else follows.
⏱ 2–3 hours totalSend document requests to your Tier 1 suppliers with a 14-day deadline. AI extracts dates and flags issues as documents arrive. Don't wait for all documents before starting to score — incomplete data is data. Flag what's missing.
⏱ 30 minutes setup, automated from thereSend security, financial stability, and operational resilience questionnaires to your Tier 1 suppliers. Review every "no" or blank answer personally. The first cycle always surfaces things you didn't know — that's the point.
⏱ 1 hour to send, auto-chased from thereWhile Tier 1 remediation is in progress, run the lighter Tier 2 assessment. This is typically documents + insurance certificate only, with a questionnaire added if anything looks concerning. Red flag resolution for Tier 1 should be substantially complete by end of Month 3.
⏱ Parallel workstreams reduce total timeBy this point you have a documented, scored, partially-remediated risk register. Export it. This is your answer the next time an enterprise customer asks for evidence of your third party risk process — and it's the baseline your annual reviews will compare against.
⏱ One click — under 60 secondsAutomated expiry alerts and news monitoring run continuously. Annual re-assessment cycles are scheduled based on tier. The ongoing time commitment for a 40-supplier portfolio is approximately 30–60 minutes per month — mostly resolving the flags that automation surfaces.
✅ 30–60 min/month ongoingEvery guide covers how to onboard and assess third parties. Almost none cover what happens at the end of a relationship — which is where some of the most significant risks are created. Vendor offboarding is the overlooked stage of the TPRM lifecycle.
When a supplier relationship ends, they may still hold your customer data, have active API credentials, or retain system access that was never formally revoked. This is a direct data protection and security risk that persists indefinitely without a structured offboarding process.
Ending a contract doesn't immediately end all legal obligations. Insurance requirements, confidentiality obligations, and IP ownership terms often survive the commercial relationship. Understanding your ongoing rights and obligations — and those of the departing supplier — requires a structured contract review at termination.
Operational risk doesn't pause during a supplier transition. The period between offboarding an existing supplier and fully onboarding a replacement is typically the highest-risk window in the entire relationship lifecycle — because service continuity depends on two suppliers cooperating, which they have limited incentive to do.
VendorAuditly maintains a complete audit trail of every supplier relationship — including the offboarding record — so your evidence of due diligence is preserved even after the relationship ends. Archived vendor records are retained and exportable on all paid plans.
Start free →Each guide covers a specific component of third party risk management for small businesses — from supplier assessment to document tracking to questionnaire templates.
Import your supplier list, upload their documents, and let AI flag what needs attention. Free forever on up to 3 third parties — no credit card, no security team required.
Free forever on 3 vendors · No credit card · Cancel any time