Third-Party Risk Assessment: A Methodology That Survives an Audit

Ask a security team how they assess vendors and the answer is usually some version of: “we send them a questionnaire.” Ask what happens to the answers and it gets vaguer. They go in a folder. Someone skims them. If nothing looks alarming, the vendor gets approved. There’s rarely a common scoring model, rarely an evidence standard, and rarely a clear line from “this answer concerns me” to “here’s the treatment, here’s the owner, here’s the date.”

That’s not a risk program — it’s a compliance ritual. A third-party risk assessment methodology is what turns the questionnaire into a decision, and does it the same way every time so the results hold up when an auditor or a board asks how a particular vendor got approved.

The Flow

A repeatable assessment moves through eight stages, and the order matters:

1. Asset / vendor scoping. What does this vendor touch — which data, which systems, which business process? What would break, and how badly, if they failed or were breached?
2. Threat and vulnerability. What’s the realistic threat model for this class of vendor, and what weaknesses are plausible?
3. Likelihood. How probable is a material incident, given the threat landscape and what’s known about the vendor?
4. Impact. What’s the business consequence — regulatory, financial, operational, reputational?
5. Inherent risk. Likelihood times impact, before considering the vendor’s controls. This score sets everything downstream: due-diligence depth, evidence bar, reassessment cadence.
6. Controls. Evaluate the vendor’s control design and — critically — the operating evidence. Not “do they claim to encrypt,” but “can they show a current SOC 2 Type II that covers it.”
7. Residual risk. What’s left after the controls are accounted for. This is the number that drives the decision.
8. Treatment. Accept, mitigate, transfer, or avoid — with an owner, a target date, and an escalation threshold if the date slips.

Why Inherent Risk Comes First

The most common failure in vendor risk programs is scoring on paperwork. A well-resourced vendor with a polished SOC 2 and a slick questionnaire response scores well. A smaller vendor that handles something genuinely sensitive but has thinner documentation scores worse. The program feels rigorous and gets the priority order backwards.

Scoring inherent risk first fixes that. A vendor processing regulated customer data with a production integration is high inherent risk regardless of their certifications — and that score, not the quality of their sales collateral, determines how hard you look. High inherent risk means deeper due diligence, a higher evidence bar, and annual-plus-event reassessment. Low inherent risk means a lighter touch. The controls evaluation then tells you how much of that inherent risk the vendor actually retires.

Evidence, Not Attestations

Every control in the assessment carries an evidence standard. A claim without evidence — “we have an incident response plan” with nothing to show — is recorded as an evidence exception, and evidence exceptions are a finding class in their own right. They’re where questionnaire programs quietly fail: the answers all said yes, and none of them were checked.

Acceptable evidence includes a current SOC 2 Type II or ISO 27001 certificate scoped to the relevant controls, a penetration test executive summary, architecture and data-flow documentation, and direct artifacts like console screenshots or policy documents. Expired certifications count as exceptions until renewed.

What the Program Produces

• A documented risk assessment methodology — the scoring model, tiers, and evidence standards, written down so assessments are consistent across assessors and over time
• A living risk register covering both internal and third-party risk
• A third-party questionnaire structure aligned to the scoring model, not a generic template
• Control and evidence assessments per vendor
• Residual-risk scoring that drives the approve / conditions / reject decision
• A treatment and escalation workflow — owners, dates, and what happens when a date is missed

A representative management view: high-risk vendors tracked as a standing number, assessments due this cycle, open evidence exceptions, residual-critical items awaiting treatment, and a review cadence that’s annual-or-event for critical vendors and longer for the rest.

Getting Started

If your vendor assessments currently live in a folder and there’s no single answer to “how did this vendor get approved and when are we looking again,” that’s the gap. SG2’s compliance and risk practice stands up the methodology, the register, and the treatment workflow as a running program — one scoring language for internal and third-party risk, and reporting your auditors and board can consume directly.