Vendor Risk Management Checklist (Updated 2024)

Vendor Risk Management (VRM) is a broad category that encompasses all measures that your organization can take to prevent data breaches and ensure business continuity. Legal issues, past performance, and creditworthiness are some of the common VRM issues that all companies review frequently. Additionally, cybersecurity and the reduction of third-party security risks are increasingly important.

An efficient vendor risk management audit process ensures that your vendor assessment process stays current, protects sensitive information, and improves your organization's risk management process.

For organizations to truly be protected they must audit and continuously monitor not only their third-party relationships, but also the standards, regulations, and best practices they use as the foundation of their third-party risk management framework.

Download your free vendor risk management checklist here.

What are the Steps in a Vendor Management Audit?

Any successful audit begins with establishing an audit trail. This includes the third-party risk assessment framework and the operating model, living documents that guide the process, as well as categorize vendors based on a security risk assessment that uses an approved methodology.

Next, organizations must supply vendor report reviews that prove ongoing governance throughout the vendor lifecycle.

What Should the Third-Party Risk Assessment Framework and Methodology Documentation Contain?

Before you can assess a third-party vendor or establish your operating model, you need to develop a third-party risk assessment framework and methodology that categorizes vendors based on predetermined inputs.

Your choice of third-party risk management framework should be based on your regulatory requirements, acceptable level of risk, use of third-parties, business processes, joint ventures, compliance requirements, and overall enterprise risk management strategy. It will likely take into account the desires of senior management and the Board of Directors.

Learn how to select a third-party risk assessment framework >

What Does an Organization Need as Part of its Operating Model Documentation?

The operating model refers to the policies, procedures, processes, and people you have in place to guide your vendor management processes. Many organizations, consistent with regulatory expectations, organize their operating model into three lines of defense (LOD):

1. The business line, which generates, owns, and controls the risk.
2. The support functions, which provide oversight to the first line, and include the risk disciplines of operational risk and compliance among others.
3. The internal audit, whose remit is derived from the board to process-audit the first and second lines of defense

These lines (and the documents that outline their functions) act as the foundation fo any third-party risk management program. Here is a list of checks you can use to assess the maturity of your operating model and documentation.

Risk Assessment Policy

1. Has a structured way of assessing information value
2. Has documented and established risk assessment methodology (qualitative, quantitative or a combination)
3. Identifies and prioritizes assets
4. Identifies common threats
5. Identifies vulnerabilities
6. Has a consistent and non-bias way to assess vendors such as a security ratings tool
7. Analyzes existing and where necessary, implements new controls
8. Calculates the likelihood and impact of various scenarios on a per-year basis
9. Prioritizes risks based on the cost of prevention vs information value
10. Documents results in a risk assessment report
11. Uses a well-established security questionnaire

Learn how to perform an IT cyber security risk assessment >

Vendor Management Policy

1. Vendors are categorized by risk levels
2. Assesses and establishes minimum requirements for human resources security
3. Assesses and establishes minimum requirements for physical and environmental security
4. Assesses and establishes minimum requirements for network security
5. Assesses and establishes minimum requirements for data security
6. Assesses and establishes minimum requirements for access control
7. Assesses and establishes minimum requirements for IT acquisition and maintenance
8. Requires vendors to document their vendor risk management program
9. Outlines vendor's incident response plan requirements
10. Defines the vendor's business continuity and disaster recovery responsibilities
11. Sets out vendor compliance requirements
12. Outlines acceptable vendor controls

Sets out minimum vendor review requirements (e.g. SOC 2, site visits, and auditing requirements)

Learn more about vendor management policies >

Vendor Management Procedures

1. Has workflow to engage in vendor management review
2. Designates a stakeholder to track vendors, relationships, subsidiaries, documents, and contacts
3. Has someone who is responsible for vendor due diligence
4. Uses software to deliver and collect vendor risk assessments such as UpGuard Vendor Risk
5. Has a documented process to coordinate legal, procurement, compliance, and the rest of the business when onboarding, working with, and offboarding a vendor
6. Has metrics and reports used to assess the performance of a vendor
7. Vendor manages cybersecurity risks with industry-standard frameworks.

What Documentation Supports Vendor Report Reviews and Ongoing Governance?

Vendor report reviews are an important part of ongoing governance. This can come in the form of continuous security monitoring or manual review of documentation that attests to security. Here are a few checks you can use to understand your vendor report maturity:

1. Reviews audit reports like SOC 2 and ISO
2. Reviews security questionnaires
3. Reviews financial reports
4. Reviews financial controls policy
5. Reviews operational controls policy
6. Reviews compliance controls policy
7. Reviews reported data breaches and data leaks
8. Reviews access control policy
9. Reviews change management policy

Note these reviews should be on a regulator basis to ensure changes do not go unnoticed.

What is Vendor Lifecycle Management?

Vendor lifecycle management is a cradle-to-grave approach to managing vendors in a consistent way. Vendor lifecycle management places an organization's vendors at the heart of the procurement process by recognizing their importance and integrating them into the procurement strategy.

Any good vendor risk management program starts with adequate due diligence on all third-party vendors and service providers. This can be done with a combination of continuous security monitoring and attack surface management tools that can automatically assess the externally observable information security controls used by existing and new vendors.

Once this initial stage has been completed, any high-risk vendors should be sent a vendor risk assessment to complete that can assess their internal security controls, regulatory compliance, and information security policies.

In general, modern vendor lifecycle management involves five stages:

1. Qualification: This first phase starts with the process of need identification and solicitation. This can involve simply searching the web or be a complicated RFP process where potential vendors are informed about your organization's need to acquire a specific good or service.
2. Engagement: Once a vendor has been selected, they undergo a vendor onboarding process where both you and the vendor are onboarded.
3. Information security management: This stretches from the initial contact of a potential vendor through to the delivery of the good or service and to the end of the vendor relationship. Information security isn't traditionally part of vendor risk management. However, the risk of security breaches has increased which has led to its inclusion. This stage is different to the other stages as the controls that protect customer data and sensitive data need to continually evolve as threats change.
4. Delivery: This is where the vendor delivers the good or service and also includes vendor performance management which can reduce reputational risk and improve disaster recovery.
5. Termination: This stage is straightforward for a low-value vendor. However, if it is a high-value vendor, offboarding can be anything but simple. To ensure vendors are offboarded properly, you need to ensure all contractual obligations are fulfilled and any sensitive data has been handed over or destroyed.

Learn how to choose automated vendor risk remediation software >

Before diving into vendor lifecycle management, you need to plan out your supplier relationship management process from beginning to end. This will aid in future audits as you'll be able to find any vendor risk management policies, procedures, and processes that address each step in the lifecycle.

We've compiled a list of possible checks you can use that can play a role in the procurement process and aid decision-making. Not every item is necessary, but the more you complete, the more you'll be able to mitigate risk.

With that said, due diligence processes will vary by company, industry, and region. Some regulations such as NIST and HIPAA, dictate specific vetting practices and some industries have adopted standardized processes. Additionally, requirements can be different based on the type of vendor being assessed.

Vendor Qualification Checklist

Collecting this information ensures that the company is legitimate and licensed to do business in your sector. You'll also want to collect information on key people for use in further risk assessments.

1. Have articles of incorporation (or corporate charter)
2. Have a business license
3. Provided company structure overview
4. Provided biographical information of senior management and Board members
5. Located in a country that is within our acceptable risk level
6. Provided proof of location via photographs, on-site visit, or video conference
7. Provided references from credible sources
8. Obtained insurance documentation

After assessing that the business is legitimate, you'll want to asses whether the vendor is financially solvent and paying taxes. There's no point using a vendor due to close up shop in the next month. Conversely, strong growth in a vendor could forecast increased prices later.

1. Obtained tax documents
2. Reviewed balance sheet and financial statements
3. Understand credit risk and other liabilities
4. Reviewed major assets
5. Understand compensation structure, staff training, and licensing

Learn about the top VRM solution options on the market >

Vendor Engagement Checklist

Now that you've assessed that the vendor is a legitimate business who is financially solvent, it's important to understand they are on any watchlist, have negative news, or could pose a danger to your organization. This is important because vendors often have access to sensitive information or systems. Corruption or political weaknesses can be dangerous and a security incident at a vendor can affect your organization too.

1. Vendor is not on any watch lists, global sanctions lists, or lists published by regulators
2. Key personnel have been checked against politically exposed persons (PEP) lists and law enforcement lists
3. Risk-related internal policies and procedures have been reviewed
4. Reviewed reports from agencies like the Consumer Financial Protection Bureau
5. Reviewed vendor's and key personnel's litigation history
6. No negative news reports or acceptable level of negative news
7. Acceptable amount of negative reviews and complaints on sites like G2 Crowd and Gartner

Now that you've assessed that the vendor is suitable from a political and operational risk perspective, you should assess whether the business has appropriate business continuity planning in place. You want to know whether the vendor is exposed to operational risks that could negatively impact your organization. This could be downtime for a SaaS provider or key personnel turnover for a services business.

1. Vendor has an incident response plan
2. Vendor has a disaster recovery plan
3. Vendor has adequate business continuity planning
4. Employee turnover rates are acceptable
5. No pending or past employee lawsuits or other indicators of toxic culture
6. Acceptable amount of negative employee reviews on Glassdoor
7. Vendor has a code of conduct in place
8. Finally, it's time to assess the quality of the contract itself.
9. Contract has defined terms and timeframes
10. Contract includes a statement of work
11. Contract includes delivery dates
12. Contract includes a payment schedule
13. Contract includes information security requirements
14. Contract includes supply chain and outsourcing information security requirements
15. Contract includes termination or renewal information
16. Contract includes a clause to be able to terminate contract when security requirements are not met

Vendor Information Security Management Checklist

1. Vendor has a security rating that meets our expectations
2. Vendor security rating has been benchmarked against their industry
3. Vendor has invested in data protection and information security controls
4. Vendor uses access control such as RBAC
5. Vendor is willing to complete a risk assessment checklist
6. Vendor has provided an IT system outline
7. Penetration testing results for the vendor are acceptable
8. Visited vendor's site to assess physical security
9. Vendor does not have a history of data breaches
10. Vendor employees do routine cybersecurity awareness training
11. Vendor has IT ecosystem security controls in place for mitigating the impact of cyberattacks and data breaches.
12. Vendor doesn't introduce an unacceptable level of cyber risk

Vendor Services Delivery Checklist

Once you've come to terms with the information security management requirements, it's time to monitor how the vendor is delivering the services (or goods) that you paid for.  

1. Deliverables are scheduled
2. Receivables are scheduled
3. Senior management understands who is responsible for working with the vendor
4. Security team accepts any physical access requirements
5. Security team accepts system access requirements
6. Invoice schedule is established
7. Payment mechanism is established

Vendor Termination Checklist

Finally, the last part of the vendor management lifecycle is to understand how to offboard the vendor. This stage can range from simple to incredibly complex, depending on how intertwined your business is with the vendor. To ensure you offboard vendors properly, ensure that you develop a robust checklist. Here are some checks that you can use.

1. Physical access has been revoked
2. System access has been revoked
3. Contractual obligations have been fulfilled
4. Sensitive data has been handed over or destroyed

How UpGuard Can Enhance Your Vendor Risk Management Program

UpGuard Vendor Risk can minimize the amount of time your organization spends assessing related and third-party information security controls by automating vendor questionnaires and providing vendor questionnaire templates. We can also help you instantly benchmark your current and potential vendors against their industry, so you can see how they stack up.

Our expertise has been featured in publications such as The New York Times, The Wall Street Journal, Bloomberg, The Washington Post, Forbes, Reuters, and TechCrunch.

To make your VRM program as efficient as possible, UpGuard leverages AI technology to streamline processes commonly causing progress disruptions. An example of an area in great need of such an influence is vendor risk assessments.

UpGuard’s AI Autofill feature provides vendors with questionnaire response suggestions by drawing on a comprehensive database of their previously completed questionnaires. This results in much faster questionnaire completions, improving the efficiency of your overall Vendor Risk Management program.

Watch this video for an overview of UpGuard's AI Autofill feature.