Who’s Responsible for Vendor Assessments?

While the responsibility of risk management should fall on each organization, it isn’t always so simple. It would be great if every vendor would monitor themselves and reduce risk to an appropriate level, but the problem is that not every vendor is this responsible. Even more, a thorough risk management program does not eliminate risk or guarantee protection. As a result, this means you should assume at least some level of risk from each third party. Knowing this fact, the responsibility for vendor assessments falls on your organization. Your vendor can have a risk management program in place, but ultimately you are responsible for monitoring your own risk, which entails assessing all third-parties that you choose to do business with. For example, are you aware of all the information your vendors have access to? According to Optiv, 74% of companies do not know all of the third parties that handle their data and personally identifiable information. Sharing any information increases the likelihood that you will have a data breach if your vendor creates a vulnerability, even more so when you don’t know which data is vulnerable. In the instance of a breach, your company is held responsible in the eyes of the law and you can be fined for regulatory violations. In the case of you being a customer facing organization, such as a wholesaler or retailer, you will also be seen responsible in the eyes of the public who does business with you. This can cause irreparable damage to your brand. Within your organization, responsibilities may vary. You may have a dedicated team or even a vendor manager, and the role generally depends on the size of your organization and the resources you have available. Ultimately, responsibility falls on the board who should be directing personnel to manage risk, and how they choose to do so is at their discretion. 

How to Perform a Vendor Assessment

In a traditional assessment process, you would begin with determining the regulatory requirements, standards, or best practices you’re going to be assessing against your selected vendor(s). You would also determine which tools and processes you would use. For example, in a manual process you might upload all of this content into a spreadsheet. Using assessment software, such as RiskWatch, you would upload or select the content for your assessment in the application. Next, you’ll identify who will be participating in gathering the assessment data, whether that is a hired consultant, someone from your own organization, or perhaps an employee selected by the vendor. This individual or individuals will send emails or meet with necessary personnel to gather the required data. That data will the then be analyzed. After analyzing the assessment data, you’ll gain valuable insight into your vendor’s risk and your own risk. Develop and draft corrective actions to mitigate risk and set requirements for your vendor. Track corrective actions and ensure risk is reducing and compliance is improving over time. 

Vendor Assessment Automation

Using a vendor assessment platform, such as RiskWatch, will greatly reduce the effort required to monitor your vendors. This is thanks to our lean process flow, provided content , and subject matter expertise, which all contribute to your success. Our platform enables your vendor to submit their own data through a custom portal – just send them a link and they can submit all required information within a set timeframe. If your vendor does not submit the requested information by set dates, escalation automatically occurs in the system, sending reminders to relevant personnel. From there, the platform automatically analyzes data collected, giving a real time risk and compliance score, and suggesting tasks to mitigate risk. Automatic reports are also generated with any selected data, making your findings ready to present at a moments notice.