Third-party risk management, in most organizations, is a questionnaire at onboarding. It is completed by the supplier's sales team, reviewed by someone with no authority to reject the supplier, filed, and never revisited. It satisfies an audit requirement. It manages very little risk.
What the Questionnaire Cannot See
The questionnaire captures a supplier's self-description at a single moment, usually the moment they are most motivated to describe themselves well. It cannot see what changes afterwards: the sub-processor added, the region moved, the certification lapsed, the acquisition, the incident that was handled without telling customers because the contract did not require it.
It also flattens a portfolio. A supplier holding customer records and a supplier providing office plants receive the same treatment, which means the effort is spread evenly across relationships whose risk is not remotely even.
A Workable Alternative
Tier by what they touch: the depth of assessment should follow data sensitivity, access and operational dependency — not contract value, which is the proxy usually reached for.
Put the obligations in the contract: notification timelines, sub-processor change notice, audit rights and evidence obligations are worth more than any questionnaire answer, because they are enforceable.
Re-assess on a cycle and on events: a scheduled review for critical suppliers, plus triggers — an incident, an acquisition, a change of region or sub-processor.
Know the concentration: several suppliers resting on one underlying provider is a single point of failure that no individual assessment reveals.
Plan the exit before you need it: the ability to leave, and to get your data back in usable form, is a control. It is also the one least often tested.
“You cannot outsource the obligation. When a supplier loses your customers' data, it is still your customers' data.”
The Honest Constraint
Doing this properly across a supplier portfolio of any size is a continuing workload, and it is usually the first thing to lapse when the team is stretched — which is why it tends to be discovered as a gap during an audit rather than managed as a risk. Tiering exists precisely to make the workload survivable: assess the suppliers that matter properly, and be deliberate rather than apologetic about assessing the rest lightly.
