A vendor risk assessment process turns vendor due diligence from a one-off spreadsheet exercise into a repeatable system that catches risky suppliers before they touch your data. This guide walks through the exact steps to build one in 2026, from vendor inventory to ongoing reassessment.
Why this matters
Most UK businesses that get breached through a third party never assessed that vendor's security posture in the first place. ISO 27001 and SOC 2 both require documented supplier risk management, and Cyber Essentials Plus audits increasingly ask what happens when you onboard a new supplier.
OneClickComply automates the evidence-gathering side of vendor risk assessment so certification audits don't stall on missing paperwork. A vendor risk assessment process built once in 2026 should keep running with minimal manual effort — that's the point of building it properly the first time.
What you'll need
- A full list of active vendors and suppliers, including ones the finance team pays but IT never onboarded
- A risk tiering framework (critical, high, low — three tiers is enough for most SMEs)
- A standard security questionnaire template, ideally mapped to ISO 27001 Annex A or SOC 2 Trust Services Criteria
- A place to store evidence: certificates, questionnaire responses, penetration test summaries
- A named owner for the process — someone who chases non-responders
- 2-4 weeks for the first full pass across all existing vendors
The steps
1. Build your vendor inventory
List every third party that touches your data, your network, or your customers' data — including SaaS tools, contractors, and payment processors. Most companies find 20-40% more vendors than they expected once finance and IT compare notes. Missing vendors here means gaps in your ISO 27001 or SOC 2 supplier register later, and auditors will ask for the full list, not the convenient one.
Common mistake: stopping at vendors IT directly manages and missing ones the marketing or sales team signed up for on a company card.
2. Tier vendors by risk exposure
Sort every vendor into critical, high, or low risk based on what data they touch and how deeply they're integrated into your systems. A payroll processor holding employee bank details is critical; a stock photo subscription is low risk. This tiering decides how much scrutiny each vendor gets — you don't need a 200-question audit for a vendor with zero data access.
Common mistake: tiering by contract value instead of data access. A £500/year tool with admin access to your production database is higher risk than a £50,000 marketing retainer with none.
3. Choose your assessment method per tier
Critical vendors get a full security questionnaire, a request for their SOC 2 report or ISO 27001 certificate, and a review of their subprocessor list. High-risk vendors get a shorter questionnaire and a certificate check. Low-risk vendors get a lightweight self-attestation form. This step is what stops the process from collapsing under its own weight — assessing every vendor at the same depth burns out whoever owns the process by month three.
4. Send questionnaires and collect evidence
Send the tiered questionnaire and log responses as they come in, with a hard deadline (10 business days is standard for critical vendors). Security questionnaire automation removes the manual chasing and spreadsheet-tracking that kills most vendor risk processes within the first year. Expect 60-70% of vendors to respond within the first deadline — the rest need the escalation step below.
Common mistake: accepting a vendor's marketing page as evidence of security posture instead of a signed questionnaire or certificate.
5. Score and document findings
Score each response against your tiering criteria and flag anything below your acceptance threshold — no MFA, no incident response plan, expired certifications. Document the decision either way: approved, approved with conditions, or rejected. Auditors for ISO 27001 and Cyber Essentials Plus want to see the decision trail, not just the raw questionnaire.
6. Set remediation deadlines and escalation paths
When a vendor fails an assessment, give them a fixed remediation window (30-60 days is typical) and a named internal escalation path if they miss it — usually procurement, then legal. Vendors that never respond to a security questionnaire after two follow-ups should trigger a contract review, not indefinite silence. This is the step most companies skip, and it's the one auditors probe hardest in 2026.
7. Schedule ongoing reassessment
Critical vendors get reassessed annually at minimum; high-risk vendors every 12-18 months; low-risk vendors on contract renewal. Set calendar triggers now, because a vendor risk assessment process that only runs once during onboarding isn't a process — it's a snapshot. A vendor's security posture in 2026 tells you nothing about their posture in 2027 without a scheduled check.
8. Automate what you can
Manual tracking in spreadsheets works for the first 10 vendors and breaks down after that. Automating questionnaire distribution, evidence storage, and reassessment reminders is what keeps a vendor risk assessment process alive past its second year. This is the step most SMEs underinvest in, and it's the reason most vendor risk registers go stale within 18 months.
Automate vendor risk assessment
OneClickComply handles evidence collection and reassessment scheduling end-to-end.
Troubleshooting
Vendor won't respond to the questionnaire. Escalate to procurement after two missed deadlines and flag the contract for review at renewal — silence on security is itself a data point.
Nobody in-house can interpret a SOC 2 report. Focus on the exceptions section first; a clean report with zero exceptions is the fast pass, anything flagged needs a follow-up question, not a guess.
Questionnaire fatigue is slowing responses across all vendors. Shorten the low-risk tier questionnaire to under 15 questions — most non-responses come from vendors who see a 100-question form and deprioritise it.
Tiering criteria are too vague and everyone ends up "critical". Anchor tiers to a single hard question: does this vendor have access to production data or systems? Yes moves them up a tier automatically.
Reassessment dates keep slipping. Set the reminder at the point of first assessment, not a year later when nobody remembers the original deadline — this is the single biggest cause of stale vendor registers.
A vendor refuses to share a Cyber Essentials or SOC 2 certificate. Treat refusal as equivalent to a failed assessment for critical and high-risk tiers; legitimate vendors share certification status without pushback.
Tools and resources
- Best vendor risk management software for UK SMEs — comparison of platforms built for exactly this process
- A questionnaire template mapped to ISO 27001 Annex A controls or SOC 2 Trust Services Criteria
- A shared evidence repository with version history, not a shared drive folder that gets overwritten
- A calendar system with reassessment triggers set at the point of first approval
What to do next
Run the full inventory-to-tiering pass across every existing vendor before you touch new onboarding — retrofitting a process onto 40 unassessed vendors later is far harder than starting clean. Once the tiering and questionnaire steps are running, automating evidence collection is the next lever, and it's where most of the manual hours in this process disappear.
Frequently asked questions
One last thing
The vendor risk assessment processes that survive past year one all share the same trait: reassessment is scheduled at the moment of first approval, not left for someone to remember later. Skip that single step and the entire register goes stale by the second year, no matter how good the initial tiering was.