Vendor Risk
The risk your third-party vendors introduce into your operations, data, and compliance posture.
Vendor risk (also called third-party risk or TPRM) covers everything a supplier could break for you — a breach of your data, a compliance failure, or a service outage. Modern TPRM programs continuously monitor vendor security posture, financial health, and control attestations.
The average SMB carries dozens of critical vendors. Most only review them at contract signing, if at all.
Assess the relationship, not just the brand
The same vendor can create different risks in different workflows. Public content scheduling is not equivalent to holding payroll records or administrator access. Record what the provider does, the information it receives, its access permissions, and how dependent your business is on its continued service.
A practical review sequence
Assign a relationship owner, classify the inherent risk, collect proportionate evidence, and record the decision. For a critical provider, examine incident notification, recovery arrangements, subcontractors, and how you would retrieve data or exit the service. Track unanswered questions as gaps instead of treating missing evidence as a clean result.
Distinguish evidence from inference
A published breach report or general rating is not proof that your own account was affected. A completed questionnaire is a vendor’s assertion unless supported by evidence. Date the assessment, record its sources and limits, and revisit material changes so a vendor approval does not become a permanent assumption.
Related terms
See how Scarlet Risk covers Vendor Risk.
One platform for compliance, cyber, vendor, and world-watch risk.
Schedule Live Demo