Vendor risk assessment: why every supplier waits

Two requests reach procurement on the same Monday. One is for a stationery supplier. The other is for an analytics tool that will hold a copy of your customer data. Both get the same security questionnaire, and both join the same queue behind legal.

Three weeks later, both are approved. The stationery order waited for nothing. The analytics tool answered the same twenty questions as the stationery supplier, and nobody asked where it stores the data.

Supplier review is the step in procure-to-pay that decides whether a new supplier can be trusted with what it will reach. When it runs the same way for every supplier, it is slow for most of them and light for the few that matter.

What is a vendor risk assessment?

A vendor risk assessment checks a new supplier against what it will be able to reach: your data, your systems, your money or your customers. It sets the depth of the review by that risk, collects the evidence, and tracks any conditions of the approval until they are met.

Why reviews stall, and still miss the risky suppliers

1. One questionnaire for every supplier. The review has no tiers, so a caterer and a data processor answer the same questions.
2. Reviewers work in sequence. Security waits for legal, legal waits for finance, and each handoff is an email.
3. The request doesn’t say what the supplier will reach. It says what is being bought, not which systems or data it touches, so the reviewer has to ask.
4. Conditions are agreed and then forgotten. “Approved once they turn on SSO” sits in an email thread, and nothing checks that it happened.
5. Access grows after approval. A supplier approved for a pilot gets a production integration a year later, and nobody reviews it again.

What it costs

The first cost is time. Teams that wait three weeks for a low-risk supplier learn to buy on a card instead, and the purchase skips review altogether. The larger cost is the supplier that got a light check because it looked routine, and now holds customer data under conditions nobody verified.

What to fix first

1. Ask what the supplier will reach on the request. Data, systems, money or customers. One question at the start sets the depth of everything after it.
2. Tier the review by that answer. A supplier with no data access gets a short check. One that will hold customer data gets the full security review.
3. Run reviewers in parallel. Security, legal and finance see the request at the same time, each with their own part.
4. Track conditions as tasks with owners. An approval with conditions stays open until each one is confirmed.
5. Review again when access changes. A new integration or a new type of data reopens the assessment.

The guide to building vendor security review has the prompts for each step.

Where it fits

Review comes before supplier setup, so a supplier only reaches the ERP once it has passed. It depends on the purchase request saying what the supplier will reach, which most request forms don’t ask.

For the whole procure-to-pay process, from purchase request to paid supplier, see the procure-to-pay process.