Vendor Risk Management Programme: A Regulatory Guide
A vendor risk management programme is the structured, repeatable system your organisation uses to identify, assess, monitor, and respond to risks introduced by third parties. Not a spreadsheet. Not an annual questionnaire. A documented, evidenced, continuously operational programme.
Trusted by 100+ organisations across Europe
NIS2 
DORA 
ISO 27001:2022 
Vendor Risk Management What you need to know about vendor risk management programmes
- A vendor risk management programme is a continuous, evidenced system covering the full vendor lifecycle, not a periodic questionnaire exercise.
- NIS2 Article 21 and DORA Article 28 impose mandatory programme requirements on European organisations.
- The six core components are vendor inventory, tiering methodology, due diligence procedures, continuous monitoring, incident escalation, and audit evidence.
- The most common regulatory failures are incomplete vendor inventories, static point-in-time assessments, and poor evidence quality.
- Continuous monitoring means automated alerts and triggered reassessments, not annual reviews or calendar reminders.
- Programme metrics must cover vendor coverage, risk quality, and remediation response.
- Automation is not optional at scale. Manual processes cannot sustain the continuous monitoring and evidence requirements that regulators now expect.
Source: StartComply Editorial. Generated January 2025.
Regulators Audit Your Programme, Not Just Your Policies.
A documented, evidenced, continuous programme
- A complete vendor inventory covering all third parties with access to systems, data, or regulated processes
- Risk-based vendor tiering based on criticality, exposure, and data sensitivity
- Due diligence and reassessment procedures mapped to regulatory obligations
- Continuous monitoring between formal assessment cycles
- Timestamped evidence for assessments, findings, escalations, and remediation closure
Penalty exposure: NIS2 fines reach €10 million or 2% of global annual turnover for essential entities. Important entities face fines up to €7 million or 1.4%.
Spreadsheets, email threads, annual questionnaires
- Incomplete inventory caused by shadow IT, legacy contracts, and departmental procurement
- Static onboarding assessments that are not repeated when risk changes
- No automated monitoring for incidents, financial distress, sanctions, or certification changes
- Findings tracked in personal spreadsheets with no documented closure
- No escalation path for vendors that refuse to complete assessments
- Calendar reminders treated as controls, even though they do not prove oversight
The audit reality: regulators ask for files, dates, owners, decisions, follow-ups, and proof that the programme is operating continuously.
What a Vendor Risk Management Programme Actually Covers
A vendor risk management programme is not a single activity. It is a continuous cycle of interconnected processes, each feeding the next. Most organisations treat it as a project. Regulators treat it as a permanent obligation.
The programme spans the full vendor risk management lifecycle: pre-contract due diligence, onboarding risk assessment, in-life monitoring, contract review triggers, and offboarding. Each stage produces evidence. Each piece of evidence maps to a regulatory requirement.
The scope of your programme must cover all vendors who touch your information systems, critical infrastructure, or regulated processes. Under DORA Article 28, financial entities must maintain a register of all ICT third-party service providers. Under NIS2 Article 21, essential and important entities must address supply chain security as part of their risk management measures.
The Six Core Components
Every compliant vendor risk management programme contains six components: vendor inventory, tiering methodology, due diligence procedures, continuous monitoring, incident and escalation procedures, and audit evidence. Missing any one creates a gap that auditors will find.
A programme is permanent. It is not a one-off questionnaire exercise. It must operate continuously and produce evidence whenever a regulator, auditor, board member, or customer asks for it.
Six Components of a Compliant Vendor Risk Programme
Vendor Inventory
A complete, maintained register of every third party with access to your systems, data, or regulated processes.
- Central vendor record for every supplier relationship
- Ownership, contract, service, and data access details
- Coverage across ICT providers, service providers, and operational suppliers
Tiering Methodology
A documented, risk-based approach for classifying vendors by criticality, exposure, and impact.
- Critical, high, standard, and low risk tiers
- Classification based on data sensitivity and operational dependency
- Proportionate controls for each vendor tier
Due Diligence Procedures
Standardised assessments applied at onboarding and throughout the relationship, mapped to compliance obligations.
- Security, resilience, privacy, and sub-processor checks
- Evidence collection from vendors
- Consistent scoring and finding generation
Continuous Monitoring
Automated oversight between formal assessments, so risk changes are detected when they happen.
- Security incident alerts
- Financial distress and sanctions monitoring
- Triggered reassessments for material changes
Incident and Escalation Procedures
Defined workflows for vendor breaches, failed assessments, overdue remediation, and non-responsive vendors.
- Escalation to contract owners and risk owners
- Documented risk acceptance decisions
- Closure evidence for remediation actions
Audit Evidence
A centralised, retrievable record of every assessment, finding, decision, and remediation action.
- Timestamped assessment records
- Monitoring logs linked to vendors
- Regulator-ready evidence repository
Building Your Vendor Risk Management Programme: Step by Step
Build the vendor inventory Inventory
Start by listing every vendor. Pull data from procurement systems, IT asset registers, finance invoicing data, and shadow IT audits. Most organisations discover 30 to 50% more vendors than they thought they had.
Classify vendor risk Risk model
Apply a tiering model using data sensitivity and operational criticality. See our vendor risk management framework for a detailed methodology.
Design the assessment process Due diligence
Tailor each vendor risk management questionnaire by vendor tier. Tier 1 vendors receive comprehensive security, resilience, and sub-processor checks. Lower tiers receive proportionate assessment.
Watch vendor risk continuously Continuous oversight
Monitor vendor incidents, financial distress, sanctions, certification lapses, and material changes in scope. DORA Article 28 requires continuous monitoring of ICT third-party providers.
Trigger remediation and decisions Response
When a vendor falls below your risk threshold, the programme should create findings, assign owners, set due dates, and escalate overdue actions.
Measure programme performance Board reporting
Track coverage, risk quality, and remediation response. Board-level reporting should be at minimum quarterly, with material changes escalated immediately.
StartComply vs Manual Vendor Risk Management Programmes
Not every approach produces the continuous evidence that NIS2, DORA, and ISO 27001 auditors expect.
StartComply was built for European organisations that need a vendor risk management programme they can operate continuously and prove during an audit.
Vendor Risk Programme Priorities at a Glance
Regulatory Requirements Your Programme Must Address
European regulators now specify programme requirements in concrete terms. Your vendor risk management programme must be designed against those obligations, not against generic best practice.
NIS2 Article 21
Essential and important entities must implement measures addressing supply chain security, including the security practices of direct suppliers and service providers.
DORA Article 28
Financial entities must maintain a documented ICT third-party risk policy, a complete register of contractual arrangements, and ongoing monitoring. For more context, read our guide to third party vendor risk management for financial institutions.
DORA Article 30
Vendor contracts must include minimum clauses such as audit rights, incident notification expectations, sub-contracting controls, and exit strategies.
ISO 27001:2022 Supplier Controls
Annex A Controls 5.19 to 5.22 cover information security in supplier relationships and require evidence that controls are operating.
Evidence on Demand
The competent authority in your member state can request evidence of your programme at any time. Your records must be complete, timestamped, and retrievable.
Common Failures That Regulators Identify
Incomplete Vendor Inventory
Organisations cannot demonstrate oversight of vendors they have not recorded. Shadow IT, legacy contracts, and departmental procurement outside central IT create blind spots.
Static Risk Assessments
Onboarding due diligence is not enough. A vendor that passed assessment two years ago may now have a different security posture, ownership structure, or incident history.
Poor Evidence Quality
Compliance claims collapse when assessments sit in email threads, findings live in personal spreadsheets, and remediation actions have no documented closure.
Measuring Whether Your Programme Is Working
A programme without metrics is unmanageable. You cannot improve what you do not measure, and you cannot report to the board on something you cannot quantify.
The core metrics for a vendor risk management programme fall into three categories: coverage, quality, and response. Coverage metrics show what percentage of your vendor population has a current, valid risk assessment. Quality metrics show the distribution of risk ratings across your vendor portfolio. Response metrics show how quickly findings are remediated and what percentage remain open past their due date.
Board-level reporting on vendor risk should be at minimum quarterly, with material changes escalated immediately. Operational teams need weekly visibility on open findings and overdue reassessments. For a complete breakdown, see our vendor risk management metrics guide.
StartComply turns programme data into reports automatically. Coverage dashboards, risk trend analysis, and remediation velocity reports are available without manual aggregation.
Frequently Asked Questions About Vendor Risk Management Programmes
What is the difference between a vendor risk management programme and a policy?
A policy states what your organisation intends to do regarding vendor risk. A programme is the operational system that delivers it. The policy says you will conduct due diligence on all critical vendors. The programme is the inventory, tiering methodology, assessment workflows, monitoring cadence, and evidence repository that make that policy real. Regulators audit programmes, not policies.
How often should vendor risk assessments be repeated within a programme?
Frequency should be risk-based, not fixed-calendar. Tier 1 vendors typically require annual full reassessment plus continuous monitoring for material changes. Tier 2 vendors may be assessed every 18 to 24 months. Any vendor should be reassessed immediately when a triggering event occurs, such as a disclosed incident, a contract renewal, a change in scope, or a lapsed certification.
What evidence does a vendor risk management programme need to produce for regulators?
Regulators typically expect a complete vendor register with risk classifications, assessment records for each vendor, questionnaire responses, scoring rationale, remediation evidence, closure dates, monitoring logs, and incident records where vendor-related events occurred. All evidence should be timestamped, retrievable, and linked to the specific vendor and assessment it relates to.
Does a small or mid-sized European company need a formal vendor risk management programme?
If you are classified as an essential or important entity under NIS2, or if you are a financial entity subject to DORA, a formal programme is not optional. It is a legal requirement. Smaller organisations in scope often find that a proportionate, automated programme is faster and cheaper to build than maintaining manual processes.
How do you handle vendors who refuse to complete risk assessments?
Refusal to engage is itself a risk indicator. Your programme should define a documented escalation path: initial request, follow-up, escalation to the contract owner, and ultimately a risk acceptance decision at an appropriate authority level. For critical vendors, non-engagement may trigger contract review or termination clauses. Document every step for audit purposes.
What is the role of automation in a vendor risk management programme?
Automation is what separates a programme that satisfies regulators from one that collapses under its own weight. Automation handles questionnaire distribution, response chasing, scoring, finding generation, remediation tracking, reassessment triggers, monitoring alerts, and evidence archiving. Your team can then focus on risk acceptance decisions, escalations, and vendor negotiations.
