Vendor Management: Definition and Auditor Expectations
Vendor management (also called third-party risk management or TPRM) is the discipline of ensuring your suppliers don't become your weakest link. It covers selection, onboarding, ongoing monitoring, and offboarding — plus the paperwork trail that proves you did each step.
What's in Scope
A vendor is in scope for formal management when any of the following apply:
- They handle customer data on your behalf (sub-processors under GDPR).
- They handle regulated data (PHI under HIPAA, cardholder data under PCI DSS).
- They operate critical infrastructure your product depends on.
- Their outage would be customer-visible within an acceptable time window.
Internal rule of thumb: if you'd want to know they're compromised within hours, they're in scope.
The Vendor Lifecycle
1. Pre-contract due diligence. Security questionnaire, SOC 2 / ISO 27001 report review, financial check, insurance verification, DPA signed. Document everything with dates.
2. Risk tiering. Rate each vendor by inherent risk (data sensitivity × business criticality) and apply differentiated controls. Not every vendor needs quarterly review.
3. Contract. DPA (data processing agreement) if personal data is involved. SLA with downtime penalties. Right-to-audit clause. Breach notification SLA.
4. Ongoing monitoring.
- High-risk vendors: annual re-assessment, continuous monitoring (BitSight / SecurityScorecard-style), review new SOC 2 / ISO reports.
- Medium-risk: annual questionnaire + SOC 2 report review.
- Low-risk: periodic review, exception alerts.
5. Offboarding. Data return / destruction attestation, access revoked, agreements closed, inventory updated.
What Auditors Check
- Current list of all third-party vendors — the inventory itself is often the first finding.
- Each vendor has a tier and a last-reviewed date.
- SOC 2 / ISO 27001 reports on file for high-risk vendors, not expired.
- DPAs signed for every processor of personal data.
- Breach notification clauses in contracts.
- Evidence of actual monitoring, not just "monitoring is defined in the policy".
See also vulnerability assessment — vendors' vulnerabilities become your vulnerabilities.
Common Audit Findings
- Shadow vendors. Engineering spun up a new SaaS; procurement doesn't know. Fix by connecting billing to the vendor register.
- Stale SOC 2 reports. Vendor's report expired 8 months ago; nobody re-pulled.
- Standard contract without DPA. No lawyer involved for a personal-data-processing vendor.
- No tiering. All vendors treated equally. Means high-risk ones are under-reviewed and low-risk ones over-reviewed.