Vendor risk management, done proportionately

Most vendor risk programs review every supplier the same way and therefore review none of them well. Tier first: the handful of vendors that could take your business down or expose your customers deserve real work, and the rest deserve a two minute check and a record that you did it.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

A workable third-party risk program at a Canadian company of 100 to 500 people reviews about 10 to 25 critical vendors properly each year and handles everything else with a short standard check. It costs roughly $18,000 to $60,000 CAD a year in effort, mostly analyst time rather than executive time, and the largest single saving available is deciding which vendors do not need the full treatment.

Two obligations sit underneath this in Canada and both are frequently missed. Under PIPEDA, an organisation remains accountable for personal information transferred to a third party for processing and must use contractual or other means to provide a comparable level of protection. Under Quebec's Law 25, there are additional requirements around communicating personal information outside Quebec, including an assessment of the privacy implications. Neither duty transfers with the data, which is the same principle OSFI states for financial institutions in Guideline B-10. Put it in your own policy in those words.

Tier first, and be ruthless about it

Tiering is where the program is won or lost. The question is not how large the vendor is, it is what happens to you if they fail or are breached.

At a 250 person company that usually resolves to something like ten to twenty critical, thirty to sixty important, and a long tail of a few hundred standard, most of which are single-seat tools someone expensed. Trying to run the critical process across all of them is how programs stall in the first quarter and are quietly abandoned in the second.

What to actually ask a critical vendor

Long questionnaires produce long answers nobody reads. Eight questions, answered properly and followed up on, beat two hundred answered by a sales engineer with a template.

• Current SOC 2 Type 2 or ISO 27001 certificate, and the actual report rather than the badge
• Exceptions and qualifications in that report, and what they did about them
• What data of ours they hold, where it is stored, and whether it leaves Canada
• Their subprocessors, and how you are told when the list changes
• Incident notification: how fast, to whom, and from what trigger
• Who at the vendor has access to our data, and whether that is logged
• Their recovery objectives, and when they last tested a restore
• How we get our data out and how long they keep it after we leave

Read the report rather than the badge. A SOC 2 Type 2 with a scope that excludes the product you are buying, or with a list of exceptions the vendor never mentioned, is a common and quiet finding. If you do not have anyone who can read one, that is the kind of narrow judgement task a fractional security leader is good value for, and it is priced as a standalone item on fractional CISO services.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

The contract terms that matter more than the questionnaire

A questionnaire is a snapshot of one Tuesday. Contract terms are what you can act on in eighteen months when something happens.

A 200 person Canadian company is not renegotiating terms with a hyperscaler, and pretending otherwise wastes a quarter. Where the vendor will not move, record the gap on your risk register, have the business owner accept it explicitly, and spend your negotiating effort on the mid-sized vendors where it will work.

Keeping it running without hiring for it

1. Intercept at procurement, not after. A review that happens after the contract is signed is a report, not a control. The single highest-value change most companies make is a required field in the purchase workflow asking what data the tool will touch.
2. Give every vendor a business owner. Security runs the process, the business owner answers for the relationship. A register where security owns every vendor is a register nobody else maintains.
3. Reassess on change, not only on the calendar. A vendor that gets acquired, moves hosting, or has a public incident should be reviewed then, regardless of when its annual review is due.
4. Watch the concentration. Six critical vendors on one cloud provider in one region is a single point of failure your register may show as six separate low risks.
5. Track expiry dates of their certificates. A lapsed SOC 2 at a critical vendor is a finding in your own audit, and nobody will tell you.

The other side of the desk

Most companies reading this are also on the receiving end of somebody else's vendor risk process, and the two problems are the same problem. Every hour spent answering questionnaires is an hour not spent on your own program, and at a B2B company with large customers this can consume half a security retainer. Publishing a trust page with your certification status, your subprocessor list, your data locations and your incident notification commitment removes a large share of inbound questions before they are asked. If your customer is a federally regulated financial institution, what is driving their diligence is covered on OSFI regulated institutions, and it explains why their questions are harder than everyone else's.

If a customer has sent you the questionnaire and there is nobody internally to answer it, answering a security questionnaire with no security owner covers what to say, what you may honestly answer no to, and who should sign it.

Common questions