Third-party risk management
A proportionate approach that a small team can keep running, not a framework that sits on a shelf.
Third-party risk management means understanding what could go wrong because you rely on suppliers, and doing something about it. Standards such as ISO 27001 and sector rules such as FCA outsourcing requirements expect you to show this. But the basics are the same for any organisation.
1. Know who your suppliers are
You can't manage risks you can't see. Start with one register of every supplier, its owner, what it does for you, what you spend, and when its contract ends. Spend data from your finance system is a good way to find suppliers nobody has registered.
2. Decide which ones matter
Tier your suppliers by value, dependency and risk (see our supplier tiering guide). Spend most of your effort on the top tiers and on any supplier with access to sensitive data or systems.
3. Assess the risks
For each supplier that needs it, look at the main risk areas:
- Information security: access to your data and systems, and how they protect it.
- Data protection: personal data, where it is held and the contract terms that cover it.
- Financial: could the supplier fail?
- Operational: what happens to your service if they stop?
- Concentration: are you relying on one supplier for too much, or on several suppliers that all rely on the same provider?
- Compliance: sanctions, modern slavery, anti-bribery and sector rules.
Rate inherent risk first, then residual risk after the supplier's controls and your own.
4. Act on what you find
An assessment that finds problems and changes nothing is worse than none, because it proves you knew. For each significant finding, agree an action, an owner and a date. If you accept a risk, record who accepted it and why.
5. Put it in the contract
Make sure the contract covers what matters: security requirements, breach notification times, audit rights, sub-contracting, data return and deletion, and exit support.
6. Monitor, don't just onboard
- Reassess on a schedule set by tier.
- Track certificate and insurance expiry dates.
- Review performance and incidents at regular meetings.
- Reassess when something changes: a breach, a new service, new data or an ownership change.
7. Plan for the exit
For critical suppliers, write down how you would leave: notice periods, data return, the alternative supplier and how long a switch would take. Test the plan for the most important ones.
8. Keep the evidence
Auditors want to see what you checked, when, who decided and what you did next. Keep assessments, approvals and actions together for each supplier, so you can produce them quickly.
Keep it proportionate
A short assessment done every year for the right suppliers is better than a long one done once for everyone. Start with your top suppliers and build from there.
Doing this in SupplierVault
SupplierVault keeps your supplier register, tiers and risk assessments together, schedules reassessments by tier, tracks remediation actions and produces audit packs. Read more about supplier risk and tiering and audit trail and reports, or try it in the live demo.