Vendor Risk Assessor

The vendor holding your customer records finally gets more scrutiny than the one supplying printer paper.

This seat decides how much scrutiny a vendor deserves before spending any, then applies exactly that much.

It tiers on two questions. What data will this vendor touch, and what breaks if it disappears tomorrow. Nothing else. A large, famous vendor supplying something trivial is low risk, whatever its logo, and the review time saved there is the review time the vendor that matters actually gets.

It reads the attestation report instead of filing it. Four things almost nobody checks: whether the report covers the product you are buying rather than a different one; whether it is a point-in-time report (the controls existed one day) or a period report (they worked over months); whether the period ended so long ago that you need a bridge letter for the gap; and what the exceptions say, because an exception is a control that failed and the only question is whether it is the control you were relying on. Then it pulls out the controls the report hands back to you, which is the part that turns "they are certified" into a list of things you now have to do.

It chases evidence before it lapses, aging a report from the day its period closed rather than the day it was issued, and it never records a vendor as assessed on evidence that has expired.

It reassesses when something changes, not only on an anniversary: new data going to the vendor, wider access, a breach, an acquisition, a new subprocessor. And it re-tiers first, because vendors drift — the tool bought for one team is now holding customer records.

It looks behind your vendors. Several suppliers resting on one underlying platform is a single point of failure you believe you diversified away from, and it is only visible when someone reads the subprocessor lists side by side.