Vendor Management Module

Third-Party Risk Assessment and Vendor Risk Monitoring

✓ Complete Production Ready Automated Scoring
📑 Module Contents

Module Overview

The Vendor Management module enables organizations to assess and monitor third-party vendor risks through structured questionnaires, automated risk scoring, and continuous monitoring. Located under the Risk Management menu.

Why Vendor Risk Management Matters

Third-party vendors represent significant risk exposure. Data breaches, compliance failures, and operational disruptions at vendor organizations can directly impact your business. This module helps you:

Vendor Database

Centralized repository of all vendors with contact info and risk levels

Risk Assessments

Questionnaire-based assessments using customizable checklists

Auto Risk Scoring

Automatic calculation of vendor risk scores based on assessment responses

Assessment History

Track all assessments conducted over time with full audit trail

Implementation Tip

Start by adding all critical vendors (those with access to sensitive data or critical operations). Conduct baseline risk assessments, then schedule annual reassessments. Use the automated scoring to prioritize high-risk vendors.

Why Vendor Risk Management?

The Third-Party Risk Challenge

Modern organizations rely heavily on third-party vendors for critical services. This dependency creates significant risk exposure that must be managed proactively.

Data Security

Vendors with access to your data can expose you to breaches. 60% of data breaches originate from third parties.

Compliance

Regulations (GDPR, NDPR, SOX) require you to monitor vendor compliance. You're liable for their failures.

Operational Risk

Vendor failures can disrupt your operations. Critical vendors need continuous monitoring.

Reputation Risk

Vendor misconduct or failures can damage your reputation by association.

Vendor Risk Management Lifecycle

1. Add Vendor
→
2. Initial Assessment
→
3. Risk Scoring
→
4. Monitor
→
5. Reassess

Key Features

What Vendor Management Provides

Search & Filter

Find vendors by name, service, or filter by risk level (Critical/High/Medium/Low)

Vendor Profiles

Complete vendor information including contacts, contracts, and renewal dates

Questionnaires

Customizable assessment questionnaires from checklist library

Risk Scoring

Automatic calculation: Risk Score = (No Responses / Total Questions) × 100

Assessment History

Complete history of all assessments with dates and assessors

Evidence Notes

Capture notes and evidence references for each assessment response

Vendor Database

Adding a New Vendor

Navigate to Vendor Management

From the Risk Management menu, select "Vendor Management". You'll see the vendor list with search and filter options.

Click "Add New Vendor"

Click the blue "Add New Vendor" button to open the vendor creation modal.

Enter Vendor Information

Fill in the required fields:

FieldRequiredDescription
Vendor Name Yes Legal name of the vendor organization
Service Description Yes What services/products they provide
Contact Person Yes Primary contact name
Contact Email Yes Primary contact email address
Contract Renewal Date Recommended When the contract expires/renews
Risk Level Auto Initially set manually, updated by assessments
Save Vendor

Click "Add Vendor" to save. The vendor is now in your database and ready for risk assessment.

Search and Filter

The vendor list includes powerful search and filter capabilities:

// Search by vendor name or service Search: "IT Services" → Finds all vendors with "IT Services" in name or description // Filter by risk level Filter: Critical → Shows only Critical risk vendors Filter: High → Shows only High risk vendors
Best Practice

Add all vendors who have access to sensitive data, critical systems, or provide essential services. For small vendors with minimal risk, a basic profile is sufficient. For critical vendors, conduct full assessments.

Risk Assessment Process

Conducting a Vendor Risk Assessment

Navigate to Vendor Details

From the vendor list, click "View Details" for the vendor you want to assess.

Start New Assessment

Click "New Risk Assessment" button. A modal will appear asking you to select a questionnaire.

Select Questionnaire

Choose from available vendor assessment questionnaires in your checklist library. These questionnaires should cover:

  • Information Security: Data protection, access controls, encryption
  • Business Continuity: Disaster recovery, backup procedures
  • Compliance: Regulatory compliance, certifications
  • Operational: Service levels, performance monitoring
Complete Questionnaire

For each question, select a response:

ResponseWhen to UseRisk Impact
Yes Control/procedure is in place No Risk
No Control/procedure is NOT in place Adds Risk
N/A Question not applicable to this vendor Neutral
Add Notes/Evidence

For each response, you can add notes or reference evidence documents. This is crucial for audit trails and future reassessments.

Save and Complete

Click "Save and Mark as Completed". The system will:

  • Calculate the risk score automatically
  • Update the vendor's risk level
  • Save the assessment to history
  • Redirect to vendor details page

Automated Risk Scoring

How Risk Scoring Works

The system automatically calculates vendor risk scores based on assessment responses. The methodology is straightforward: "No" responses indicate missing controls, which increase risk.

// Risk Score Calculation Formula $total_questions = COUNT(all questions in questionnaire) $no_count = COUNT(responses where answer = 'No') $risk_score = ($no_count / $total_questions) × 100 // Example: 20 questions, 5 "No" responses $risk_score = (5 / 20) × 100 = 25% Risk Score

Risk Level Classification

Based on the calculated risk score, vendors are automatically classified into risk levels:

Risk Score Risk Level Badge Color Action Required
> 75% Critical Red Immediate attention required. Consider alternative vendors.
51-75% High Orange Senior management review. Mitigation plan required.
26-50% Medium Yellow Monitor closely. Schedule follow-up assessment.
≤ 25% Low Green Acceptable risk. Annual reassessment sufficient.
Understanding the Score

A higher percentage means higher risk. A score of 80% means 80% of controls are missing (80% of answers were "No"). Aim for scores below 25% for critical vendors.

Risk Score Display

On the vendor details page, you'll see a prominent display showing:

  • Calculated Risk Percentage: The numeric score (e.g., 35%)
  • Risk Level Badge: Color-coded classification (e.g., Medium)
  • Assessment Date: When the score was calculated
  • Assessment History: All previous scores for trend analysis
Score Updates

Risk scores are recalculated with each new assessment. Old scores remain in history for trend analysis. The latest score determines the current risk level displayed on the vendor list.

Complete Workflow

End-to-End Vendor Risk Management

1. Add Vendor to Database
↓
2. Create Assessment Questionnaire
↓
3. Conduct Assessment
↓
4. Auto-Calculate Risk Score
↓
5. Update Vendor Risk Level
↓
6. Monitor & Reassess

Workflow Details

Phase 1: Vendor Onboarding

Add vendor to database with complete contact information. Set initial risk level based on service criticality.

Phase 2: Baseline Assessment

Conduct initial risk assessment within 30 days of onboarding. Use comprehensive questionnaire covering all risk areas.

Phase 3: Risk Treatment

For High/Critical risk vendors:

  • Discuss findings with vendor
  • Request remediation plan
  • Set timeline for improvements
  • Consider contract amendments
Phase 4: Ongoing Monitoring

Risk Level → Reassessment Frequency:

  • Critical: Quarterly reassessment
  • High: Semi-annual reassessment
  • Medium: Annual reassessment
  • Low: Biennial reassessment
Phase 5: Contract Renewal

Before contract renewal:

  • Review latest risk assessment
  • Check for incidents/breaches
  • Verify compliance certifications
  • Update risk level if needed

Module Integrations

How Vendor Management Connects to Other Modules

Checklist Library

Assessment questionnaires are created in the checklist library and reused across vendor assessments. Maintain consistent questions.

Risk Register

High-risk vendors can be added to the risk register as "Third-Party Risk" for executive monitoring and mitigation tracking.

Compliance Management

Vendor assessments can include compliance questions. Non-compliant vendors trigger compliance management workflows.

Audit Engagements

Critical vendors may be selected for vendor audits. Assessment results inform audit planning and scope.

Data Flow Example

// Vendor Risk Integration Flow 1. Vendor Assessment Completed ↓ 2. Risk Score Calculated (e.g., 65% = High Risk) ↓ 3. Vendor Risk Level Updated to "High" ↓ 4. If High/Critical → Create risk in Risk Register ↓ 5. Link vendor risk to relevant KPIs ↓ 6. Schedule follow-up assessment ↓ 7. If compliance issues → Trigger compliance workflow ↓ 8. Add to audit universe for potential audit
Integration Benefits

By integrating vendor management with other modules, you get:
• Holistic view of third-party risk
• Automated risk register updates
• Compliance issue tracking
• Audit planning insights
• Executive-level risk reporting

Best Practices

Vendor Risk Management Guidelines

Categorize Vendors by Criticality

Not all vendors need the same level of scrutiny. Categorize:

  • Critical: Access to sensitive data, essential services
  • High: Important services, some data access
  • Medium: Standard services, limited data access
  • Low: Commodity services, no data access
Use Standardized Questionnaires

Create standardized questionnaires in the checklist library:

  • IT Vendors: Focus on security, backups, access controls
  • Financial Vendors: Focus on compliance, audits, regulations
  • Service Vendors: Focus on SLAs, continuity, performance
Document Everything

For each assessment:

  • Add detailed notes for "No" responses
  • Reference evidence documents
  • Record remediation commitments from vendor
  • Track follow-up actions
Monitor Continuously

Don't wait for reassessment:

  • Monitor vendor news for incidents
  • Track contract renewal dates
  • Review service level performance
  • Watch for regulatory changes affecting vendor
Escalate High Risks

For Critical/High risk vendors:

  • Escalate to senior management
  • Create risk register entries
  • Develop contingency plans
  • Consider alternative vendors
Review Before Renewal

Before contract renewal:

  • Conduct fresh assessment
  • Review incident history
  • Verify certifications current
  • Negotiate improved terms if needed
Compliance Standards Alignment

ISO 27001 Information Security:
• A.15 Supplier Relationships: Information security policies for supplier relationships
• A.15.1 Supplier Relationships Policy: Agreements include security requirements
• A.15.2 Supplier Service Delivery Management: Monitor and review supplier services
• Third-Party Risk: Regular vendor security assessments

SOC 2 Trust Services Criteria:
• Vendor Management: Controls over third-party service providers
• Risk Assessment: Vendor risk assessments and due diligence
• Monitoring: Ongoing vendor performance monitoring

GDPR/NDPR Data Protection:
• Article 28 (GDPR): Processor requirements and data processing agreements
• Section 2.9 (NDPR): Data processing agreements with vendors
• Third-Party Transfers: Cross-border data transfer safeguards

NIST Cybersecurity Framework:
• ID.SC-1: Cyber supply chain risk management processes identified
• ID.SC-2: Suppliers and third-party partners identified
• ID.SC-3: Contracts with suppliers include security requirements
• ID.SC-4: Suppliers and third-party partners monitored

Industry Resources

For more detailed guidance on vendor risk management:
• FFIEC IT Examination Handbook: Third-Party Risk Management
• OCC Bulletin 2013-29: Third-Party Relationships Risk Management
• ISO 27036: Information security for supplier relationships
• Shared Assessments Program: Standardized vendor assessment tools