Vendor risk management (VRM) is how a company identifies and manages the risks that come with its vendors and suppliers, before signing them and for as long as it works with them. For most businesses, that comes down to three questions: can the vendor keep paying its debts and delivering (financial risk), is it facing lawsuits, regulatory action, or sanctions (legal risk), and would being tied to it hurt your name (reputational risk). Cybersecurity is a fourth area, usually handled through security questionnaires and audits rather than a background check.
Vendor risk management (VRM) describes the practice of assessing the potential business threats posed by the external entities a company works with, specifically its vendors and suppliers. It’s also referred to as supplier risk management and falls under the broader category of third-party risk management (TPRM), which includes contractors, service providers, and business partners.
The goal of VRM is to evaluate the risk profile of third-party vendors both before establishing a business relationship and throughout the duration of the contract. The due diligence process spans the entire vendor lifecycle, including onboarding and offboarding.
Businesses work with vendors across a wide variety of functions and industries, including:
No matter their function, any type of vendor can pose financial, legal, or reputational risk, which makes sanctions screening a key component of vendor due diligence. This makes having a comprehensive vendor risk management plan essential.
Businesses are becoming increasingly dependent on third-party vendors to handle essential functions, particularly in a digitally transformed, remote-work world. Consider how many companies depend on software companies like Salesforce, AWS, and QuickBooks for their day-to-day operations.
Third-party vendors offer external expertise so that businesses can scale more efficiently. That reliance also means a vendor’s problems can become yours. A supplier short on cash misses deliveries, a contractor facing a lawsuit or a regulatory action pulls your project into it, and a partner in the news for the wrong reasons puts your name next to theirs. For that reason, VRM has become a standing function, overseen by senior leadership as well as dedicated risk management teams.
Vendor-related risks can affect all kinds of businesses regardless of industry, geography, and size, underscoring the consequences of not screening companies in your business network. However, effective VRM helps companies uncover and mitigate vendor risks before they can negatively impact their operations or reputations.
Because vendors span a variety of functions and industries, the risks they pose are not one and the same. Below are the three types a vendor background check speaks to, plus cybersecurity, which is assessed separately.
Financial risk is the chance a vendor can’t keep its obligations: a supplier that misses deliveries because it’s short on cash, delivers subpar goods to cut costs, or goes under mid-contract. Whether through excessive costs or lost revenue, these complications can hurt your bottom line.
The public signals often show up before the missed delivery does. Tax liens, unpaid judgments, bankruptcy filings, and UCC filings against a vendor’s assets all point to financial strain worth asking about.
A vendor can bring legal problems with it: pending lawsuits, judgments it hasn’t paid, regulatory actions, lapsed licenses, or a sanctions match on the company or its owners. In industries with especially stringent regulations like healthcare and financial services, a vendor’s compliance failure can also become yours.
A vendor’s actions can reflect poorly on your company, damaging its public image and credibility. Although more difficult to quantify than the other types of vendor risk, reputational risk is just as real.
Consider what might happen to your company’s reputation if a supplier provides you with a defective component used to make your product. Reputational risk ranges widely, from bankruptcies and negative press to corruption, unethical business practices, and involvement in dubious business dealings.
Vendors with access to your systems or data also carry cybersecurity risk. That’s assessed through security questionnaires, System and Organization Controls (SOC) 2 reports, and technical reviews, which sit outside what a background check covers. Our article on why vendor due diligence shouldn’t end at the questionnaire covers where a questionnaire stops and screening picks up.
Some vendor-related risks may be minor and easy to manage, like a missed catering delivery or a delayed project. Others carry more weight. A key supplier with new tax liens and a pending lawsuit can turn a delivery delay into a supply problem.
To that end, it’s crucial to put together a comprehensive vendor risk management strategy for your business. Below are key steps and components your strategy should include.
Vendor risk management works best when the depth of the check matches what the vendor touches. A routine supplier may need only a quick screen, while a vendor you can’t easily replace warrants a closer look at the company and the people who own it.
We screen vendors and their owners for liens, judgments, litigation, sanctions, and licensing, and can keep re-checking them through monitoring. Our vendor and supply chain page shows how that fits a supplier program, and if you’re comparing providers, here’s how to choose among due diligence companies.
.png)
