Vendor risk management
VRMAlso called supplier risk management, vendor management
Vendor risk management is the process a firm uses to assess and control the risks from the suppliers it pays for products and services. It checks a vendor's security, financial strength, resilience and compliance before a contract is signed. It then tracks those risks for as long as the vendor is used.
How it works
The process usually starts in procurement. Before onboarding, the firm sends a security questionnaire, reviews certifications such as ISO 27001 or SOC 2 reports, and checks financial statements and sanctions lists. The risk team scores the results. Critical vendors need sign-off from senior management, and the contract records service levels, data protection terms, audit rights and termination clauses.
Vendor risk management is a core part of wider third-party risk management. Regulators expect banks and insurers to apply the same discipline to a software licence or cloud contract as to a traditional outsourcing deal where the service is important. Weak vendor controls have been a common cause of data breaches and outages, which supervisors examine closely under DORA and UK operational resilience rules.
The rules
Requires ICT third-party risk management, contract terms, a register of information on all ICT providers and exit plans for critical services.
EU banks, insurers, investment firms, payment firms and other financial entitiesSets PRA expectations for due diligence, contracts, data security, ongoing oversight and exit planning across outsourcing and other material third-party arrangements.
UK banks, building societies, PRA-designated investment firms and insurersDescribes risk management across the third-party life cycle: planning, due diligence, contract negotiation, ongoing monitoring and termination, scaled to risk.
Banking organisations supervised by the Federal Reserve, FDIC and OCCCommon questions
Is vendor risk management required by law?
For many financial firms, yes in effect. DORA sets binding ICT third-party risk requirements for EU financial entities. UK and US supervisors set detailed expectations through PRA SS2/21 and the 2023 interagency guidance, which examiners use in reviews.
What does a vendor risk assessment cover?
It typically covers information security, data protection, business continuity, financial stability, regulatory compliance, sanctions and bribery exposure, and use of subcontractors. Depth depends on how critical the service is to the firm.
What is a vendor tier?
A tier is a risk category assigned to a vendor. Tiers set how much due diligence is needed, which contract terms apply and how often the vendor is reviewed. Critical vendors face the most scrutiny.
