Start with the decision and the applicable requirements
Identify why the review is needed: a new service, renewal, customer request, audit finding, material change or incident. Name the business decision and its owner before sending a questionnaire.
Ask your legal, privacy and compliance advisers which requirements apply to the organization and the specific relationship. Record the jurisdiction, contractual commitments, assurance framework, responsible reviewer and date checked. A financial-services supplier register, a privacy record and a security inventory may share data while requiring different fields and decisions. Confirm any required format and submission separately.
Maintain a requirement-to-evidence index so each reviewer can find the relevant record without creating competing supplier lists. Keep legal interpretations, reporting deadlines, penalties and regulator-specific forms under qualified review. Outsourced delivery still needs an internal owner with authority to decide what the business accepts.
Build the inventory from more than one source
Reconcile purchasing and payment records with the application inventory, external-account records and a request to department owners. Ask about free applications, card-funded subscriptions, outsourced business processes and suppliers that connect to operational systems. A contract value is useful context, but access and business dependency determine why a relationship needs review.
Merge duplicate supplier names without losing separate services, contracts or business owners. Resolve discrepancies with the people responsible for the records and note the date and source of the reconciliation. An inventory assembled from incomplete inputs should say what remains unchecked.
A practical supplier record includes:
Supplier identity and service description
Business owner and operational contact
Data categories, relevant system access and hosting locations
Material subcontractors and dependencies
Contract, renewal and notice dates
Applicable privacy or sector requirements, confirmed by the responsible adviser
Risk tier and the reason for it
Assurance requested, evidence received and unresolved gaps
Last review, next review and incident contact
Current relationship status and exit responsibilities
Use distinct views of the common record for different teams. Keep any required legal identifiers or official reporting templates as specifically reviewed fields rather than assuming a generic spreadsheet satisfies every obligation.
Match the depth of review to the exposure
Consider the service's effect on operations, the sensitivity of the information involved, the privileges granted and the difficulty of replacing it. Record the assumptions behind the tier so another reviewer can understand the decision.
Higher-exposure relationships may justify deeper assurance review, a discussion of control exceptions and closer review of contract and continuity arrangements. A limited relationship may need a narrower evidence request. Set the review cadence through your risk criteria and applicable commitments; do not assign a universal schedule or require the same questionnaire from every supplier.
Look across the portfolio as well as at individual vendors. Several services may depend on the same cloud platform, subcontractor or corporate group. List the business functions that would be affected together and consider the practicality of alternatives. This concentration view can reveal a dependency that individual risk scores do not explain.
Ask for evidence that answers your question
Explain the service in scope, why the information is needed and when the decision must be made. Agree appropriate confidentiality and transfer arrangements before receiving restricted material. Keep an owner for supplier questions and record unanswered requests as evidence gaps.
Use the following topics to shape a proportionate request:
Access: administrator authentication, relevant roles and how access is removed
Data: hosting location, protection arrangements and retention
Dependencies: material subcontractors, their role and how changes are communicated
Incidents and continuity: notification contacts, recovery arrangements, available test evidence and relevant incident disclosures
Assurance and exit: reports or certificates, relevant testing summaries, development practices where applicable, and data-export arrangements
Read a certificate for its scope, validity and issuing body. Confirm whether the service and locations you use are included. Read a SOC report for its type, period, opinion, exceptions, subservice organizations and responsibilities assigned to the customer. A SOC report is an assurance report, not an ISO certificate, and the two should not be evaluated as interchangeable documents.
Record what each item supports and what it leaves uncertain. A supplier statement, a test summary and an independent assurance report provide different kinds of evidence. If the available evidence does not answer a material question, agree a clarification, additional assurance or an explicit risk decision. Reviewing documents does not establish that every technical control has been independently tested.
Make contract questions specific enough to resolve
Take the evidence gaps to the contract owner and qualified legal adviser. Identify which security, privacy and sector-specific requirements apply before deciding which terms need attention.
A practical issues list covers incident notification and escalation; audit or equivalent assurance rights; subcontractor-change notices; documented security measures; data location and transfer arrangements; return, retention and deletion; liability and insurance; and exit assistance. For each issue, record the relevant contract section, requested change, owner and unresolved position.
Where a platform uses standard terms, compare those terms with your requirements and ask the appropriate contracting team about available amendments or assurance options. Record terms that cannot be changed and the risk decision about them. Documentation does not, by itself, make an otherwise impermissible arrangement acceptable.
Agree notification arrangements that give your incident team time to assess its own obligations. The applicable legal trigger, deadline and recipient need qualified confirmation. Avoid turning a suggested supplier response interval into a universal legal rule.
Keep a calendar and an event-driven review path
Schedule assurance updates, contract reviews and open-action checks according to the supplier's risk and your commitments. Track expiring evidence and keep incident contacts current. Record the review date, participants, changes identified, decisions and next review.
Define events that can prompt an earlier review: a reported breach, ownership change, new material subcontractor, hosting-location change, significant change to your own use of the service or a newly applicable restriction. A spreadsheet can support this work if ownership and follow-through are clear. Choose software for a defined operating need and verify its actual capabilities before relying on it.
When a supplier reports an incident, preserve the time and source of the notice, what is known and what remains uncertain. Escalate to the responsible incident and legal teams to assess affected data, access, services and notification duties. They decide any containment or credential changes under the organization's response process. Review corrective actions and continued-use or exit decisions as evidence develops; avoid presenting unverified blame as an established fact.
Supplier-related fraud also belongs in the discussion with finance. Consider independent verification of requested payment-detail changes using a previously verified contact channel, alongside the organization's payment-approval controls. These checks reduce reliance on a single email conversation; they do not guarantee that fraud is prevented.
Close the relationship deliberately
Plan the exit with the service owner, technology team, legal adviser and finance team. Confirm notice requirements and any transition assistance before the end date. Assign an owner and evidence of completion to each applicable step:
Record the termination decision and contractual notice.
Agree when new data transfers stop and how essential operations continue during transition.
Export required information and check its completeness and usability before removing the source access needed for that work.
Remove the supplier's application, remote, administrative, API and physical access as applicable.
Rotate shared secrets where necessary, with authorized technical owners responsible for execution.
Obtain the agreed data-return or deletion confirmation, subject to applicable retention duties.
Recover assets and operating documentation.
Reconcile final payments and mark the record closed only when outstanding actions have an owner or are completed.
Exercise the procedure on an appropriate relationship or controlled scenario and record the gaps found. A signed termination notice is not evidence that access was removed. If a restriction or serious supplier issue forces an early exit, assess continuity and legal constraints before acting.
Give each decision an owner
Name one person to maintain the program record and coordinate reviews. Purchasing and finance help identify the supplier base; technology owners explain access and dependencies; legal and privacy advisers assess the relevant obligations; service owners explain business impact; authorized management decides acceptance and escalation.
Use a concise management view showing suppliers by tier, overdue reviews, unresolved evidence, material dependencies, incidents and corrective actions. Record decisions and the next review date. Agree an operating workload based on the actual supplier base and response volume rather than borrowing another organization's staffing estimate.
Assemble evidence someone else can follow
An audit-ready index helps a reviewer trace the method to the decision. Depending on the scope, it can point to:
The approved supplier-risk policy and management decisions
The current inventory and documented classification criteria
Supplier review files and evidence limitations
Relevant contracts and reviewed privacy arrangements
Material subcontractor information
Dated review records and the operating calendar
Exit plans and exercise or closure evidence
Incident records and escalation decisions
Corrective actions with named owners and target dates
Give each record a version or date, an owner and a clear relationship to the supplier or requirement it supports. The number of files is less important than whether the reviewer can trace a conclusion to evidence. No fixed document count or preparation period guarantees a successful audit.
Bring supplier risk into the audit plan
Use the inventory to identify the external dependencies relevant to the audit scope. Connect supplier evidence with the controls your own organization must operate. Prioritize deeper examination where the service, unresolved exceptions or business impact warrant it, and agree the criteria before comparing suppliers.
Route audit findings into the same action and risk-acceptance process used for onboarding and renewal. Discuss unclear answers with the supplier and retain the basis for the final decision. This can make reviews more consistent and expose missing assurance, but an assessment cannot establish continuing compliance or eliminate the possibility of an incident.
Independent audit execution or technical validation of a supplier's controls needs appropriate authority, access, competence and a separately defined scope. A supplier-risk program should make that need visible rather than imply that a questionnaire has performed the test.
Common questions
Should every supplier receive the same review?
Use documented scope and tiering criteria. A supplier's data access, operational role and replaceability are more informative than its label or invoice size. Keep the reason for including, excluding or limiting a review on record.
What if a supplier will not change its contract?
Ask the responsible adviser to compare the available terms with your requirements. Record the gaps, possible mitigations and acceptance authority. If an arrangement cannot meet a mandatory requirement, a risk note is not a substitute for resolving that problem.
Can the outsourced provider own the whole decision?
The provider can perform agreed work. Your organization still needs a named owner, an approval path and a clear account of who makes the business decision. Have qualified advisers confirm any legal responsibilities that cannot be delegated.
Is a certificate or SOC report enough?
It depends on the decision and the document's coverage. Check the service, period or validity, limitations and relevant exceptions. Record any further evidence or action needed; do not treat the document's presence as automatic approval.
Who maintains the program when there is no security lead?
Assign an internal accountable owner and identify the expertise and capacity they need. Any external support should have a written scope, reporting line and decision boundary. Review the workload after a pilot rather than assuming a standard monthly allowance fits.
Do different regulatory requirements require separate lists?
A common data source can support different views, but each applicable requirement still needs to be met. Confirm required fields, formats, scope and responsibilities with the relevant advisers before deciding whether one register is sufficient.
Put the next supplier decision on firmer ground
Our Third-Party Risk Management service covers a scoped program of inventory and tiering, due-diligence standards, SOC report review methods, risk decisions and an operating cadence. Review the service scope and discuss the vendor base, evidence and deadline you need to work with.
Sources and scope of this guide
- NIST Cybersecurity Framework 2.0, 26 February 2024. The Govern supply-chain outcomes address supplier criticality, contracts, due diligence, monitoring, incident participation and activity after a relationship ends. Read CSF 2.0.
- NIST SP 800-161 Revision 1, including updates of 1 November 2024. This guidance connects cybersecurity supply-chain risk assessment with organizational strategy, policies and plans. Read the publication record and guidance.
- FBI Business Email Compromise guidance. Independently verify payment requests and changes to account numbers or procedures using a trusted contact route. Read the FBI guidance.
- AICPA SOC reporting resources. SOC reports provide CPA assurance about the stated system and controls; their intended use and covered period matter when evaluating a supplier. Read the SOC overview.
The supplier fields, questions and exit sequence in this article are our practical editorial guidance. They do not replace applicable legal, privacy, contractual or sector-specific requirements.