What Are Vendor Risk Reviews?

A vendor risk review (a.k.a risk assessment) helps you understand the risks that exist when using a vendor’s product or service. Performing a risk review is especially critical when the vendor will be handling a core business function, will have access to customer data, or will be interacting with your customers.

Vendor risk reviews are not only critical when bringing on a new vendor but are also needed to ensure that the vendor is maintaining expected quality standards without causing any risks to the company, investors or your customers.

The goals of a risk review are to:

  • Identify any risks the vendor will pose
  • Evaluate if the vendor is able to eliminate those risks
  • Monitor the risks that cannot be eliminated
  • Assess the extent that any outstanding risks may bring to the company
  • Determine if your company is willing to accept those risks

Risk assessments are typically a series of questions (or a risk matrix grid), and the answers to those questions result in an overall point value, which then identify the vendor’s risk level. A common risk level breakdown is: Low, Medium and High.

When To Perform Vendor Risk Reviews

Initial Risk Review

Risk reviews should be introduced to vendors during the Request For Proposal (RFP) process. Depending on your current RFP process, you may be able to embed your risk review assessment into the RFP. The risk review should also be used to gauge the vendor’s ability to be accurate and timely with their responses, especially providing documents you request. Everything at this point should be monitored closely, as the vendor’s performance at this stage will likely have a strong correlation to future performance.

Red flags to look out for during the risk review that could remove the vendor from consideration:

  • Does not provide any processes for safeguarding confidential data
  • Does not perform risk assessments internally
  • Does not have a formal security policy
  • Does not perform security checks across all functionality
  • Does not have a disaster recovery/pandemic plan

Ongoing Risk Reviews

I have found that the best time to perform the risk review is 180 days prior to the renewal notification notice. This normally gives ample time to identify any changes to the vendor’s risk level and lets your company respond appropriately.

It has been my experience to allow 10 business days when sending the review to the vendor to complete. Once the review is back in-house, it should only take a few hours for the VMO to review and upload the data into a vendor management software system to identify the risk levels. At this point, you can also compare the current review to the vendor’s previous reviews and spot any trends.

How Often Should Ongoing Reviews Be Conducted?

Reviews should be performed according to the vendor’s current risk level, such as:

  • Low risk vendors → Annually/bi-annually
  • Medium risk vendors → Semi-annually/annually
  • High risk vendors → Quarterly/semi-annually

You may also review the vendor more frequently than normal if any of the following indicators exist:

  • The vendor has been in business less than 3 years
  • Items discovered in the last review need to be monitored
  • Vendor files bankruptcy
  • Vendor layoffs
  • Lawsuits that include the vendor
  • Negative press releases concerning the vendor
  • Lowered ratings by agencies (BBB, Fitch, S&P, Moody’s)
  • Increased vendor incidents or non-resolution of vendor incidents

Who Handles the Review?

The Vendor Management Office (VMO) should be in charge of managing the vendor risk review process. By its nature, the VMO should provide the most non-biased view of the vendor, which is critical since vendor’s risk level classification will dictate how the vendor is managed throughout the relationship.

If the VMO finds any high-risk items on the assessment, it should engage the business owner and any other key parties. The result of this discussion can either be:

  • The decision maker accepts the high risk level and the vendor risk review is considered complete
  • The decision maker does not sign off:
    • The VMO creates an incident for each question that is labeled high-risk
    • The VMO discusses the high-risk items with the vendor and formulates an action plan for the vendor to complete
    • Once those risks are mitigated the VMO will complete a new risk review to show the changes
    • The revised review is then brought back to the business owner for final sign-off

Base the Review on the Type of Vendor

It is best to create risk reviews based on the services the vendor performs; not every vendor should be subjected to the same review form. Always keep in mind the vendor size and the risk the vendor poses to your organization — too many reviews could damage the relationship with the vendor.

Below are five common vendor types that can be used to help shape your risk review efforts:

  • Essential Services — the vendor handles customer data and customer interaction
  • Customer Facing — the vendor interacts with customer without handling customer data
  • Customer Data — the vendor handles customer data without customer interaction
  • Back Office — the vendor supports core services but has no customer interaction/data
  • Non-Essential — the vendor does not provide core services or core product

Risk Areas to Focus On

The table below shows a list of risk areas that your assessment may focus on, and which vendor types are applicable to each area.

Risk Area to Focus On Vendor Type
Handling of incident securityA process of how the vendor handles incidents where security has been breached. All vendor types
Environmental securityA safeguard to monitor and protect access to the vendor’s buildings and ensure the environment is monitored and secure, along with ensuring visitors are monitored while inside of secure areas. All vendor types
Organizational securityA process to ensure the vendor has a policy and program in place with a governance committee that oversees and audits all facets of security to protect the vendor and its clients. All vendor types
Human Resource (HR) securityA procedure where all employees and contractors are trained on handling customer information, safeguard it and how to handle breaches of the procedure. All vendor types
Pandemic readinessA documented strategy for business continuity in the event of a widespread outbreak of disease that shows how what support the vendor is able to provide during such an incident. All vendor types
Disaster recoveryThe process, policies and procedures for recovery or continuation of core technology infrastructure after a natural disaster. All vendor types
Handling data (hard and soft copy)A documented process that describes how to handle both electronic and paper files throughout the cycle of that document including destruction documents. Essential Services & Customer Facing
Customer interaction processesA defined process on how to interact with the customer that will meet the client’s expectations along with any regulatory guidelines that must be followed. Essential Services & Customer Facing
Physical securityA procedure that defines the security of the building, both offices and data center to include how to handle visitors, access into buildings and surveillance. All but Non-Essential
Asset managementA process of operating, maintaining, upgrading, and disposing of assets such as computer equipment, company phones or anything of value. All but Non-Essential
CommunicationDefines communication processes. All but Non-Essential
Access controlsA defined process to the selective restriction of access to the vendors computer systems either internal or remotely. All but Non-Essential

Example of a Vendor Risk Questionnaire

Below is a sample risk review form. Please consider it a template that you can tweak to meet your specific needs.

Vendor Response & Risk Rating
Risk Questions Low Medium High
Do you have an internal Risk Assessment program? Yes No
What is the frequency of performing Risk Assessments? Yearly > 1 year Never
Does your company have procedures employed to ensure compliance with privacy laws/regulation requirements related to maintaining security, confidentiality and protection of customer data? Yes No
Is there a designated Information Security team within the organization? Yes No
Does management require the use of confidentiality or non-disclosure agreements? Yes No
Is access to, non-public information provided to external parties? Yes No
Is there an asset management policy? Yes No
Do all employees and contractors sign agreements that pertain to non-disclosure, confidentiality, acceptable use or code of ethics upon hire? Yes No
Does the security awareness training include a testing or a certification of completion? Yes No
Is there a documented termination or change of status policy that specifically identifies which departments to notify for removal of access to systems and the building? Yes or N/A No
Are visitors required to sign in, wear a visitor badge and have a employee escort them in the building at all times? Yes No
Are there badge readers at all entries into the business? Yes No
Are there printers in a non-secured area that are allowed to print non-public data? Yes No
Are operating procedures documented, maintained, and made available to all users who need them? Yes No
Are system changes performed in a test region? Yes No
Do third party vendors have access to Client’s non-public data (i.e. contractors, subcontractors, service providers, etc)? Yes No
Are workstation scans scheduled daily? Yes No
Is there a Network Intrusion Detection/Prevention System? Yes No
If Instant Messaging is used, is communication limited and blocked to internal employees? Yes or N/A No
Do freeware or shareware applications require approval from security prior to installation? Yes No
Are inactive userID(s) deleted or disabled after a certain period of time? Yes No
Do all users have a unique userID when accessing applications? Yes No
How often are passwords reset? 90 days 90+ days When user requests
Is there a policy to prohibit users from sharing passwords? Yes No
What is the limit of unsuccessful login attempts before the account is locked? Up to 3 Up to 6 6+
When upgrades are done, does the Client have full access to the system during this process? Yes No
Is there a documented Incident Response Plan? Yes No
Are the procedures tested at least annually? Yes No
Is there an organizational data protection and privacy policy? Yes No
Does your company have a compliance and ethics training program for all employees? Yes No

Starting A Vendor Management Office

4 Steps to Getting Started with a VMO

Starting a Vendor Management Office (VMO) within a company can be quite challenging. The key is to determine the breadth and depth of services that the VMO will provide the company. With any successful implementation you need a project plan that defines the vision and mission of the VMO.

Step #1 — Know the Business

Before designing the roles and responsibilities of the VMO, you must first know the business and how current vendor relationships are managed.

Questions to ask:

  • Why did the company decide to implement a VMO?
  • What are the current challenges with vendor relationships?
  • How does each line of business (LOB) handle vendors?
  • Who currently negotiates contracts?
  • Where are the contracts, reviews, SSAE 16’s and Insurance Certificates stored?
  • Who performs vendor risk and performance reviews?
  • Who reviews and submits invoices?
  • Who handles vendor end-of-year tax processing (1099-M)?
  • Who sets up vendors in the company’s database or servicing systems?
  • Who are the business owners for the vendors?

To answer the above questions, I would suggest meeting with each functional area to discuss the questions above. This would also be the perfect time to set expectations on gathering all vendor documents, understand the services provided by the vendors, and be made aware of any current vendor incidents and active projects in the pipeline.

Step #2 — Design & Propose the VMO’s Roles & Responsibilities

The VMO team provides a support role and assists each department with vendor selection, negotiations, contract terms, monitoring vendor performance, identifying risk and handling on-site reviews. Once you have your list of issues, vendors, documents and corporate structure, it’s time to create a VMO implementation plan.

Design the Plan

Each company will vary on what roles they want the VMO to be responsible for. The company may not have performed a deep dive into all aspects of what a VMO can provide. I would suggest gathering your data from Step 1 and putting a deck together to present to the executive team.

The deck should contain:

  • Timelines for each implementation phase
  • Projected staff size
  • How you will manage the data

This is the perfect way to validate the business needs and to determine if your VMO vision meshes with the executive team’s expectations.

VMO Functions

After you analyze the company’s current vendor management approach, you need to evaluate and prioritize what functions you can provide that will eliminate risks for the company and create efficiencies for the lines of business.

I call these the 22 keepsakes of a VMO:

  1. Execution of all NDA’s
  2. Manage RFP’s
  3. Perform due diligence
  4. Negotiate costs
  5. Create contracts
  6. Contract negotiations
  7. Contract approval process
  8. Gather business requirements
  9. Negotiate contract terms
  10. Manage contract renewals
  11. Termination of vendors
  12. Maintain vendor documents
  13. Risk reviews
  14. Onsite reviews
  15. Vendor performance reviews
  16. Vendor incident resolution
  17. End-of-year processing (1099M)
  18. Invoice audits
  19. Vendor utilization
  20. Vendor setup in systems
  21. Manage vendor scorecards
  22. Purchasing/purchase orders

Keep in mind the functions you commit to may require additional staff, depending on the company’s volume of vendors.

Job Descriptions

Depending on the initial assessment of duties, you can start creating VMO roles and the set of tasks that each person will perform.

Among the roles you may consider are a contract administrator, a vendor analyst and a vendor auditor. Their typical responsibilities include:

Contract administrator

  • Assist with the RFP process
  • Review and negotiate contract terms and pricing
  • Obtain proper approvals and signatures on all contracts
  • Maintain and update as needed company standard blanket contracts
  • Manage select vendors
  • Assist with administering vendor action plans as needed
  • Conduct vendor business reviews
  • Perform other activities as assigned by the Vendor Manager

Vendor analyst

  • Research, collection, tracking and reporting of vendor SLA’s
  • Maintain information in the vendor management system
  • Track escalated issues and reporting of root cause analysis
  • Manage the archive and cataloging processes for all VMO documents
  • Tracking of agreement renewal dates
  • Assist the team in the collection and analysis of vendor information as input to the annual profit plan cycle
  • Perform invoice tracking against purchase orders as directed by the Vendor Manager

Vendor auditor

  • Perform daily activities related to managing regulatory compliance and performance of the company’s vendors
  • Partner with the Compliance Department to review changes in regulation that may apply to the company’s vendors
  • Maintain an overall vendor scorecard that relates to vendor risk and performance as related to the review analysis
  • Conduct vendor performance reviews
  • Conduct due diligence reviews during the vendor on-board process
  • Conduct vendor risk reviews as directed by company guidelines
  • Perform vendor on-site reviews as directed by the Vendor Manager

Step #3 — Select Your VMO Database

Another factor to consider is how to manage your documents, data and timelines. Building a spreadsheet can be overwhelming document for more than 100 vendors. Some things to keep in mind when planning what your database should have are:

You’ll also need to determine how you’ll manage all of the information and action items you’ll be accumulating. Using a spreadsheet can work as a bare minimum solution, but it proves to be an inadequate solution once you have more than 100 vendor and/or need features like document storage and email reminders.

You’ll want your VMO database to handle:

Document Storage

  • Vendor performance reviews
  • Risk reviews
  • Fully executed contacts
  • Vendor certifications (SSAE 16)
  • Insurance certificates
  • On-site reviews
  • Vendor incidents
  • Contract redlines
  • NDA’s
  • Email communications
  • RFP results
  • Notes
  • Misc. documents

Tracking and Notifications

  • Contract expirations
  • Vendor performance reviews
  • On-site reviews
  • Insurance expirations
  • Risk reviews
  • Vendor certifications (SSAE 16)

Quick Reference Information

  • Vendor contact info
  • Contract clauses
  • Service level agreements (SLA)
  • Cost of services
  • Termination dates

Step #4 — Implement the Plan

Now that you have the plan approved it’s time to put everything together. Being in a support role it’s imperative whatever you implement has to be simplistic for the business as well as efficient for the VMO. Whatever database you chose, ensure that the business has access to it so you can concentrate on your core functions to support the business.

In implementing any plan you should have policies and procedures for the company to follow and an internal VMO policy for your staff.

VMO Company Policy Topics

  • Vendor onboard process
  • Contract signing authority
  • Ongoing relationship with vendors
    • Contract renewals
    • Performance reviews
    • Risk reviews
    • Price changes
    • Change in terms
    • Vendor scorecards
    • Vendor issues
    • Gift policy
  • How and when to terminate a vendor

VMO Internal Policy Topics

  • When to use an NDA
  • Steps on implementing a new vendor
  • How to create and score an RFP
  • How to upload new vendors into your Customer Information System (CIS), if applicable
  • Creating and managing a risk review
  • Creating and managing a performance review
  • Processes on managing the vendor management software or database
  • How to terminate a vendor
  • Contract expiration notification process
  • How to manage and resolve vendor incidents

Implement your vendor management software or database as soon as possible. The last thing you want to have happen is for high volume or risk vendors contract to expire during this transition phase.

Once you have your policies and procedures published, a repository and tracking system and your staff hired, it’s time to officially kick off the VMO and introduce the policies and procedures and show present the value you will add to support the lines of business by managing vendor relationships and processes.

Depending on the company culture, you may wish to do a roadshow by starting with the department heads to get their buy in so they can trickle it down to their team, conducting continuing education, or email. I would suggest getting with your training department and see how they have rolled out new departments in the past.