What is a vendor risk assessment?
By Nick Jang, founder of MINERVA Studio ·
The short answer
A vendor risk assessment is a structured check of what could go wrong if you rely on a supplier: whether it could fail, leak your data, breach a law, disappear or drag down a service your customers use. It starts with how much you depend on the vendor, sets how deep the review goes, gathers evidence (questionnaires, audit reports, financials, the contract) and ends with a rating, an owner and a date to look again. Under OSFI’s B-10 it happens before the contract is signed and again for as long as the arrangement runs.
The steps
- Describe the arrangement. What the vendor will do, what data it touches, which business service depends on it, and whether it relies on its own subcontractors.
- Tier it. Decide how critical it is. A payroll processor holding every employee’s banking details isn’t the same as the company that waters the office plants.
- Gather evidence in proportion to the tier: a questionnaire, certifications and audit reports, financial statements, policies, references.
- Assess the risks across security, privacy, operational resilience, financial health, compliance, concentration, location and, for AI vendors, the models themselves.
- Agree controls and put them in the contract: audit rights, incident notice, data location, subcontracting limits, exit terms.
- Rate and decide. Record the residual risk, who accepted it and why.
- Monitor and reassess on a cycle set by the tier, and whenever something changes.
Tiering: how deep to go
Tiering keeps the effort where the risk is. Most programmes use three or four tiers.
| Tier | Typical vendor | Assessment depth | Reassessed |
|---|---|---|---|
| Critical | Core banking platform, cloud provider, payments processor, an AI model behind credit decisions | Full review: questionnaire, SOC 2 Type II or equivalent, financials, on-site or virtual audit, exit plan | Every year, and on any material change |
| High | CRM holding customer data, a fraud scoring service | Questionnaire, audit report, privacy and security review | Every one to two years |
| Moderate | Marketing tools with limited data | Short questionnaire, certifications | Every two to three years |
| Low | Office supplies, catering | Basic due diligence | At renewal |
Questionnaires and the evidence to ask for
Few teams write questionnaires from scratch. The SIG (Standardized Information Gathering questionnaire) from Shared Assessments and the Cloud Security Alliance’s CAIQ (Consensus Assessments Initiative Questionnaire) are the usual starting points, and many vendors have already filled one in.
Answers are claims. Evidence is what backs them up:
- an independent SOC 2 Type II report or an ISO/IEC 27001 certificate, read for its scope and its exceptions, not just its existence;
- penetration test summaries and the vendor’s incident history;
- audited financial statements, for vendors you couldn’t easily replace;
- the list of the vendor’s own critical subcontractors and where your data will sit;
- business continuity and recovery test results.
Extra questions for AI vendors
An AI vendor is still a vendor, but a standard security questionnaire misses most of what can go wrong with its model. Add questions like these:
- Which models does the product use, whose are they, and will you tell us before they change?
- Is our data used to train or improve your models, or anyone else’s?
- How was the model tested for accuracy and bias, and can we see the results?
- What does it log, and can we get the inputs and outputs for a decision when a customer or examiner asks?
- Which other AI providers do you rely on?
For a bank, a model inside a vendor product is also a model under OSFI E-23, so the assessment feeds the model inventory too. Our guide to third-party AI vendor risk covers the full question set.
What OSFI B-10 expects
Guideline B-10 asks federally regulated institutions to assess the risk and criticality of each third-party arrangement before entering it, scale due diligence to that risk, put the right terms in the contract, monitor performance, plan the exit and keep a register of arrangements. It has applied since 1 May 2024.
The register is where most teams struggle: knowing every arrangement, its tier, its last review and what depends on it. MINERVA keeps that register for AI suppliers, with the models each one supplies and what they reach. See third-party AI vendor risk software.
Related questions
What is the purpose of a vendor risk assessment?
To find out what could go wrong if you rely on a supplier, decide whether that risk is acceptable, and set the controls and contract terms that keep it acceptable for as long as you use the vendor.
What should a vendor risk assessment include?
A description of the arrangement, a criticality tier, evidence such as questionnaires and audit reports, an assessment across security, privacy, resilience, financial and compliance risk, agreed controls, a rating, an owner and a reassessment date.
How often should vendors be reassessed?
In proportion to their tier: critical vendors at least yearly and after any material change, lower tiers every two or three years or at renewal.
What is the difference between a vendor risk assessment and vendor risk management?
The assessment is one review of one vendor at a point in time. Vendor risk management is the whole programme: policy, inventory, assessments, contracts, monitoring and exit.
Is a SOC 2 report enough?
Rarely on its own. Read its scope and exceptions, then cover what it doesn’t: financial health, resilience, data location, subcontractors and, for AI vendors, the models.
Sources
- OSFI — Third-Party Risk Management Guideline (B-10)
- Shared Assessments — Standardized Information Gathering (SIG) questionnaire
- Cloud Security Alliance — Consensus Assessments Initiative Questionnaire (CAIQ)
- NIST — SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.