The Vendor Risk Management Process: Step-by-Step
The vendor risk management process is not a one-time exercise. It is a continuous operational discipline that regulators now examine in detail. StartComply automates every stage, from initial onboarding assessments through to continuous monitoring and audit-ready evidence trails.
Trusted by 100+ organisations across Europe
NIS2 DORA 
Assessments 
Audit-ready evidence What you need to know about the vendor risk management process
- The vendor risk management process follows five stages: inventory, risk tiering, due diligence, risk treatment, and continuous monitoring.
- NIS2 Article 21(2)(d) makes supply chain security a mandatory risk management measure for essential and important entities across the EU.
- DORA Articles 28 to 44 specify detailed process requirements for financial entities, including pre-contractual due diligence, contractual provisions, and concentration risk mapping.
- Continuous monitoring is mandatory, not optional. Vendor risk profiles change after onboarding and require ongoing reassessment at frequencies proportionate to vendor tier.
- Common process failures include incomplete vendor inventories, stale assessments, expired certificates, and no visibility into fourth-party dependencies.
- StartComply replaces manual questionnaire tracking, certificate expiry monitoring, and reporting with audit-ready workflows.
Source: StartComply Editorial. Last updated January 2025.
Vendor Risk Management Is an Auditable Process
A documented, repeatable, evidence-backed process
- Current vendor inventory with service type, data access, operational criticality, and regulatory scope
- Inherent risk tiering to determine assessment depth
- Due diligence mapped to NIS2, DORA, and ISO 27001 control requirements
- Contractual controls covering audit rights, sub-outsourcing, SLAs, and incident notification obligations
- Continuous monitoring with reassessment triggers and evidence trails
Regulatory exposure: NIS2 fines can reach €10 million or 2% of global annual turnover for essential entities. DORA requires financial entities to maintain third-party ICT risk processes and registers.
Spreadsheets, shared inboxes, and quarterly reminders
- Incomplete vendor inventories caused by shadow procurement and legacy contracts
- Questionnaires chased manually through email threads
- Expired certificates and stale assessments with no automated alerts
- No clear risk treatment approvals or escalation history
- No fourth-party visibility for critical vendor dependencies
- Reports reconstructed before audits instead of retrieved on demand
The audit reality: regulators ask for files, dates, owners, decisions, follow-ups, and evidence trails. A spreadsheet without audit trail is evidentially weak.
What the Vendor Risk Management Process Actually Involves
The vendor risk management process is the structured sequence of activities an organisation uses to identify, assess, treat, and monitor risks introduced by third-party suppliers. It is not a single audit or a tick-box questionnaire. It is a repeating cycle that begins before a vendor is onboarded and continues until the relationship ends.
Regulators across Europe are explicit about this. NIS2 Article 21(2)(d) names supply chain security directly as a mandatory risk management measure. DORA Chapter V sets out detailed requirements for financial entities managing ICT third-party risk, including pre-contractual due diligence, contractual provisions, and ongoing monitoring.
Understanding what is vendor risk management at a definitional level is useful. But the process question is where compliance teams live day to day: what do you actually do, in what order, with what evidence?
The practical test: if a regulator asked today for your vendor inventory, tiering rationale, assessment evidence, treatment approvals, and monitoring records, could you retrieve them immediately?
The Core Stages of the Vendor Risk Management Process
Vendor Identification and Inventory DORA Art. 28
Before you can assess risk, you need to know who your vendors are. Build and maintain a complete inventory that categorises each vendor by service type, data access level, operational criticality, and applicable regulatory scope. DORA Article 28(3) requires financial entities to maintain and regularly update a register of third-party ICT service providers.
Inherent Risk Tiering Risk-based depth
Not all vendors carry equal risk. Tier vendors by inherent risk using data classification, system access level, geographic processing location, and operational dependency. Critical and high-tier vendors require full due diligence assessments, while low-tier vendors may only need lightweight self-certification.
Due Diligence and Assessment NIS2 + DORA + ISO 27001
Use a structured vendor risk management questionnaire mapped to ISO 27001:2022 Annex A controls, NIS2 Article 21 measures, and DORA Article 30 contractual requirements. Evidence must be stored, version-controlled, and retrievable on demand.
Risk Treatment and Contractual Controls DORA Art. 30
Assessment findings feed into risk treatment decisions: accept, mitigate, transfer, or avoid. Contractual controls are mandatory for regulated entities, including audit rights, sub-outsourcing controls, service level definitions, and incident notification obligations.
Continuous Monitoring and Reassessment Ongoing control
Onboarding is not the end. Monitor certificate expiry dates, vendor incident notifications, threat intelligence feeds, and changes such as new sub-processors, data centre migrations, ownership changes, or security incidents. Significant changes should trigger out-of-cycle reviews.
Regulatory Requirements That Shape the Process
NIS2 Requirements for Supply Chain Risk
NIS2 Article 21(2)(d) lists supply chain security, including security-related aspects concerning relationships with direct suppliers or service providers, as a mandatory risk management measure.
- Essential entities: fines up to €10 million or 2% of global annual turnover
- Important entities: fines up to €7 million or 1.4% of global annual turnover
- Authorities can request evidence of assessments, contractual provisions, and monitoring activities
DORA Requirements for ICT Third-Party Risk
DORA applies to financial entities and has applied since January 2025. Its third-party risk requirements are among the most detailed in European regulation.
- Article 28: written ICT third-party risk policy, complete register, and risk-based due diligence
- Article 30: mandatory contractual provisions for ICT third-party arrangements
- Article 28(8): critical ICT third-party providers may be subject to direct oversight
Concentration Risk and Financial Institutions
Financial entities must map concentration risk across ICT third-party arrangements and identify where dependence on a single provider creates systemic exposure.
- Map critical ICT providers and operational dependencies
- Identify single-provider concentration exposure
- Document risk decisions for critical services
- See the third party vendor risk management for financial institutions guide
StartComply vs. Manual Vendor Risk Management Processes
A regulated vendor risk management process needs more than status columns. It needs evidence, timestamps, ownership, escalation history, and reporting that can be retrieved when regulators ask.
StartComply replaces manual questionnaire tracking, certificate expiry monitoring, and reporting with audit-ready workflows.
Vendor Risk Management Process Metrics to Track
Common Process Failures and How to Fix Them
Most vendor risk management process failures fall into predictable categories. Identifying them early saves significant remediation effort later.
Incomplete Vendor Inventories
Shadow IT procurement, M&A activity, and departmental autonomy create inventory gaps. Fix this with a formal vendor onboarding gate and automated integrations with procurement systems so new vendors trigger assessment processes automatically.
Stale Assessments and Expired Certificates
A vendor assessed eighteen months ago is not under continuous monitoring. Fix this with automated expiry tracking for certificates, assessment dates, reassessment schedules, and evidence renewal.
No Fourth-Party Visibility
Your critical vendor’s critical vendor is also your risk. DORA addresses sub-outsourcing in Article 30(3), and NIS2 does not exempt organisations from risks introduced by vendors’ vendors. See the fourth party risk management guide for a systematic approach.
Measuring and Improving the Vendor Risk Management Process
A process without measurement is unmanageable. Compliance teams need metrics that track process health, not just vendor risk scores. Key process metrics include vendor inventory coverage rate, assessment completion rate within required timelines, certificate currency rate, and mean time to remediate identified risk findings.
These metrics feed the vendor risk management metrics discipline, which connects process performance to executive reporting and regulator readiness. Audit-ready reporting requires metrics to be retrievable at any point in time, not reconstructed before an examination.
StartComply generates real-time process dashboards that track these metrics automatically. Compliance officers see completion rates, expiry forecasts, and open findings without building reports manually.
The reporting standard: when a regulator requests evidence of your third-party risk management programme, the answer should be days, not months.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
Frequently Asked Questions About the Vendor Risk Management Process
What are the main steps in a vendor risk management process?
The core steps are: vendor identification and inventory, inherent risk tiering, due diligence and assessment, risk treatment and contractual controls, and continuous monitoring and reassessment. Each step produces documented evidence that regulators can request. Skipping any step does not reduce workload. It creates audit findings and regulatory exposure under frameworks such as NIS2 and DORA.
How often should vendor risk assessments be repeated?
Critical and high-tier vendors should be reassessed at least annually. Significant changes, such as new sub-processors, data centre migrations, ownership changes, or security incidents at the vendor, should trigger out-of-cycle reviews regardless of the calendar schedule. Continuous monitoring between formal reassessments is mandatory under DORA Article 28 for ICT third-party arrangements. Low-tier vendors may follow a longer reassessment cycle, proportionate to their risk profile.
What is the difference between vendor risk tiering and vendor risk scoring?
Tiering assigns vendors to categories, such as critical, high, medium, or low, based on inherent risk factors such as data access, operational dependency, and regulatory scope. It determines the depth of assessment a vendor receives. Risk scoring produces a numerical or qualitative rating of a specific vendor’s actual control environment, based on assessment findings. Tiering happens before assessment. Scoring happens after. Both are required for a complete process.
Does the vendor risk management process apply to all suppliers or just technology vendors?
Regulatory requirements focus primarily on ICT and digital service providers, particularly under DORA. However, NIS2 Article 21(2)(d) addresses supply chain security broadly, which can extend beyond technology suppliers to any vendor whose compromise could affect your organisation’s security posture. In practice, most compliance teams prioritise vendors with data access, system connectivity, or operational criticality, regardless of whether they are classified as technology providers.
What evidence do regulators expect from a vendor risk management process?
Regulators expect a complete and current vendor inventory, documented risk tiering decisions, completed assessments with supporting evidence such as certifications and questionnaire responses, signed contracts with mandatory provisions included, treatment decisions with approvals, and records of ongoing monitoring activities. Evidence must be retrievable on demand, not reconstructed before an audit. Version control and timestamps matter. Spreadsheets with no audit trail are technically inadequate for entities subject to NIS2 or DORA.
How do you handle vendors who do not respond to risk assessments?
Non-response is itself a risk signal. Your process should define escalation steps: an initial request, a follow-up at a defined interval, and a formal escalation to the vendor’s account manager or executive contact if no response is received. If a critical vendor remains unresponsive after escalation, the organisation must decide whether to accept the risk of proceeding without assessment evidence, impose contractual penalties if the agreement includes assessment cooperation clauses, or treat non-response as grounds for relationship review. Document every step.
