Supplier risk assessment
Also called vendor risk assessment, third-party risk assessment
A supplier risk assessment is a structured review of the risks a third party brings to a firm before and during a contract. It covers operational, financial, security, legal, concentration and conduct risks. Regulated firms use the result to decide whether to contract, which controls to require and how closely to monitor the supplier.
How it works
The assessment starts when a business unit proposes a new supplier. The third-party risk team rates the inherent risk of the service, based on data access, customer impact and criticality. Higher-risk suppliers receive deeper checks, including security questionnaires, financial statements, certifications and on-site reviews. Specialist teams such as information security, data protection and business continuity score their areas, and the combined rating sets the controls and review frequency.
Regulators expect the depth of assessment to match the risk of the service. EU, UK and US guidance requires firms to assess suppliers before contracting and again on a regular basis, with stricter checks for critical services. A documented assessment is also the evidence supervisors ask for when a supplier failure causes an incident. Weak or stale assessments are a common finding in supervisory reviews.
The rules
Requires firms to assess ICT third-party providers and risks before contracting and to manage those risks across the contract life cycle.
EU banks, insurers, investment firms and other financial entitiesExpects proportionate due diligence and risk assessment of service providers before entering material outsourcing and other third-party arrangements.
PRA-regulated banks, building societies and insurersDescribes due diligence and risk assessment across the third-party relationship life cycle, scaled to the risk and complexity of each relationship.
US banking organisationsCommon questions
How often should a supplier be reassessed?
Rules leave frequency to the firm's risk-based policy. Common practice is annual reassessment for critical or high-risk suppliers and longer cycles for low-risk ones, with an extra review after incidents, ownership changes or material changes to the service.
What is the difference between inherent and residual supplier risk?
Inherent risk is the risk of the service before controls, based on factors such as data access and criticality. Residual risk is what remains after the supplier's and firm's controls are taken into account. Firms use residual risk to set monitoring.
Who carries out a supplier risk assessment?
The business owner of the relationship usually leads, supported by a third-party risk function. Specialists in information security, data protection, finance and business continuity assess their own areas. Second-line risk teams challenge the result.
Does a supplier risk assessment cover ESG risks?
Increasingly, yes. Many firms add questions on environmental impact, human rights and modern slavery, driven by sustainability reporting and supply chain due diligence rules in the UK and EU.
