- >
- Workflow>
- Vendor Risk Assessment Workflow: Six Steps and Who Approves Each
Vendor Risk Assessment Workflow: Six Steps and Who Approves Each
TL;DR
- A vendor risk assessment workflow evaluates the cybersecurity, compliance, operational, and financial risks that third-party vendors introduce.
- The six steps are inventory and tiering, questionnaires and evidence, evaluation and scoring, evidence verification, remediation before signing, and monitoring and offboarding.
- Before signing or access, every gap is closed or covered by a signed exception with a due date.
- Each step needs a named approver from Procurement, Legal, Security/IT, Risk Management, or Data Privacy.
A vendor risk assessment workflow is the sequence of checks and sign-offs a third party passes before it receives a contract or access to your systems. The checks continue after signing, through monitoring and exit.
An auditor asks who signed each gate, what they approved, and where the proof sits. A SOC 2 report saved in a shared drive answers none of those questions on its own. This page sets out the six steps, then the approver and the record behind each one for high, medium, and low risk tiers. The scope runs from the first inventory entry to the day a departing vendor’s access is revoked.
How a vendor risk assessment workflow runs
A vendor risk assessment workflow moves each vendor through five stages in order: tier, collect, score, remediate, and monitor. This page adds evidence verification after scoring and folds offboarding into monitoring, which gives the six steps below.
Step 1: Inventory and tiering
Inventory and tiering lists every vendor and rates each one high, medium, or low risk by data access, regulatory scope, and business criticality.
Keep: the vendor record and the reason for its tier.
Step 2: Questionnaires and evidence
Questionnaires and evidence collect a vendor risk assessment questionnaire (VRAQ) sized to the tier, plus SOC 2 Type II, ISO 27001, and PCI DSS attestations where card data is involved.
Keep: the responses, the certificates, and every expiry date.
Step 3: Evaluation and scoring
Evaluation and scoring rates likelihood and impact across the four risk domains and compares the inherent risk with your written risk appetite.
Keep: the ratings, the inherent risk level, and the name of the person who accepted them.
Step 4: Evidence verification
Evidence verification tests vendor claims against security rating platforms or on-site audits and checks sub-processors for fourth-party risk, the risk from your vendors’ vendors.
Keep: the rating reports, the audit notes, the sub-processor list, and the vendor’s answers on AI model governance.
Step 5: Remediation before signing
Remediation before signing closes every gap, or covers it with a signed exception and a due date, before any contract is signed or access is granted, and the option to walk away stays open.
Keep: the remediation plan with owners and due dates, signed exceptions, residual risk, and contract clauses such as SLAs, right-to-audit, breach notification, and indemnification.
Step 6: Monitoring and offboarding
Monitoring and offboarding reassesses high-risk vendors annually, medium-risk vendors on a longer cycle your policy sets, and low-risk vendors at renewal, then revokes access at exit.
Keep: the alert history, the reassessment dates, and the access revocation and data return confirmations.
Third-party risk management (TPRM) platforms sit alongside these steps by producing security ratings, assessments, and risk findings. Each platform needs a security or risk owner to review its findings and act on them.
How vendor risk is scored
Vendor risk scoring reduces to one line: Likelihood × Impact = Risk. Three terms describe what that score covers:
- Inherent risk is the exposure present before you apply any controls.
- Profiled risk is the exposure tied to a particular vendor’s relationship with your organization.
- Residual risk is the exposure that remains after controls are in place.
The two numbers that matter sit at different gates. Inherent risk is the figure step three compares with your risk appetite, which is also called risk tolerance. Residual risk is the figure step five must bring inside that same appetite. If it stays outside, a named approver signs an exception that accepts the difference, with a due date.
The record should hold both. An auditor reads the gap between inherent and residual risk as evidence that remediation worked, and reads a missing residual figure as a gate nobody closed.
Who approves each step and the record each gate leaves
Five functions sign gates in this workflow: Procurement, Legal, Security/IT, Risk Management, and Data Privacy. The signer changes with the risk tier. The Default owner column names who decides at medium risk. The High risk column adds co-signers, and the Low risk column names the role your policy delegates the decision to. Use the matrix as a starting model and edit it to match your policy.
| Step | Default owner | Gate approved | Record kept | High risk | Medium risk | Low risk |
|---|---|---|---|---|---|---|
| Inventory and tiering | Procurement proposes, Risk Management confirms | Tier assigned | Vendor record and tier rationale | Risk Management confirms, Security/IT and Data Privacy co-sign | Risk Management confirms | Delegated to Procurement under the tier rule |
| Questionnaires and evidence | Security/IT, with Data Privacy for personal data | Evidence pack complete | Responses, attestations, and expiry dates | Full questionnaire and documents, signed by Security/IT and Data Privacy | Shortened questionnaire, signed by Security/IT | Minimal documentation, delegated to Procurement |
| Evaluation and scoring | Risk Management | Inherent risk accepted against risk appetite | Likelihood and impact ratings, plus inherent risk | Risk Management and Security/IT sign | Risk Management signs | Risk Management signs, with exceptions escalated to Security/IT |
| Evidence verification | Security/IT | Claims verified | Rating reports, audit notes, and sub-processor list | Rating platform plus on-site audit where warranted, signed by Security/IT | Rating platform check, signed by Security/IT | Spot check of key attestations, signed by Security/IT |
| Remediation before signing | Legal and Procurement | Every gap closed or covered by a signed exception with a due date, or walk away | Remediation plan, signed exceptions, residual risk, and contract clauses | Legal, Security/IT, and Risk Management all sign | Legal and Procurement sign | Delegated to Procurement on standard terms |
| Monitoring and offboarding | Risk Management for reviews, Security/IT for access, Data Privacy for data | Continue, reassess, or exit | Alert log, reassessment dates, access revocation, and data return confirmation | Annual reassessment, with all three owners signing at exit | Reassessment on a longer cycle, with Security/IT and Data Privacy signing at exit | Reconfirmed at renewal, with Security/IT signing at exit |
What a gate record looks like
A gate record is one line someone else can read a year later. These illustrative entries show the level of detail each gate needs:
- Gate 1: “Tier set to high. The vendor will process customer payment data. Confirmed by Risk Management, co-signed by Security/IT and Data Privacy.”
- Gate 2: “Evidence pack complete. SOC 2 Type II report received, expiry logged for next March.”
- Gate 3: “Likelihood medium, impact high, inherent risk high and above appetite. Accepted for verification by Risk Management.”
- Gate 4: “Two sub-processors found that the questionnaire did not list. Fourth-party review opened.”
- Gate 5: “Encryption at rest not yet in place. Exception signed by Legal and Security/IT with a due date in the remediation plan. Residual risk medium, right-to-audit clause added.”
- Gate 6: “Contract ended. Access revoked by Security/IT, data destruction certificate received by Data Privacy.”
Why vendor oversight breaks down between departments
Vendor oversight fails at the handoffs, because procurement, IT, compliance, and finance each own one piece of the record and nobody owns the gaps between them. Procurement maintains the vendor list. IT tracks security assessments. Compliance manages certifications. Finance handles contract renewals. Each team keeps its own system and its own timeline, and spreadsheets do not send alerts.
Picture a critical vendor’s ISO certificate lapsing three months before the annual review, with nobody noticing until the auditor asks for it. That gap comes from split ownership, not carelessness, and a written escalation ladder closes it. An illustrative ladder alerts the vendor owner 90 days before expiry, escalates to Procurement at 60 days, and notifies the vendor and compliance leadership at 30 days. Set your own intervals in policy.
Audits ask for evidence that spreadsheets do not hold
Auditors want to see when you assessed each vendor, how you responded to compliance gaps, and what you did when a vendor’s status changed. A spreadsheet records what happened after someone checked manually. An email chain shows that someone contacted a vendor, but it does not prove systematic oversight. An edit history shows when a field changed without explaining why.
Regulators examine your oversight as well as the vendor. They ask whether you performed adequate due diligence and whether you monitored compliance over time. A lapsed GDPR attestation, HIPAA document, or SOC 2 report is a gap in your record even when no breach follows. The fix is the record itself: a dated expiry, a named owner, and a logged decision.
Where Kissflow fits in a vendor risk assessment workflow
Your ratings tool produces the findings. People act on them at the gates between the six steps. As an AI-powered enterprise application platform, Kissflow lets business teams and IT build, automate, and govern their core work through business logic.
Vendor approvals sit at the edges of core systems such as SAP, Oracle, Salesforce, and Workday. Around those systems of record, Kissflow runs the governed execution and the exceptions, and the systems stay in place.
Governance is part of the platform
Kissflow’s audit logs timestamp and attribute every action, which is the gate record an auditor reads. IT governs what business teams build.
Kissflow can sit on your own vendor list too, so step two applies to it. For that review, its certifications are SOC 1 Type II, SOC 2 Type II, SOC 3, ISO/IEC 27001, HIPAA, GDPR, and CCPA.
TPRM platforms and an approval layer compared
TPRM platforms assess the vendor. An approval layer records who across the business acted on that assessment. The question to settle before buying anything is which system holds the signed record for each gate.
| Comparison point | Spreadsheets and email | TPRM platforms | Kissflow |
|---|---|---|---|
| Main job | Lists vendors and due dates | Produces ratings, assessments, and risk findings | Builds, automates, and governs approval workflows |
| What adoption requires | Manual updates and follow-up by email | A security or risk owner to act on findings | A mapped approval matrix that IT governs |
| Decision record | Edit history and message threads | Findings, reports, and remediation or waiver decisions in the platform | Audit logs with every action timestamped and attributed |
| Scope to plan for | No alerts without manual checks | Decide how Legal, Procurement, and Finance sign-offs connect to findings | Ratings and assessments come from your TPRM platform |
Frequently asked questions
What is a vendor questionnaire?
A vendor questionnaire is the set of security, compliance, and operational questions a vendor answers about itself. A high-risk vendor answers more of them than a low-risk one. Check each response against the supporting attestation before it goes into the record.
What factors determine a vendor’s risk level?
Step one rates each vendor high, medium, or low risk by data access, regulatory scope, and business criticality. The record should keep the reason for the tier as well as the tier itself.
What types of risk does a vendor risk assessment cover?
A vendor risk assessment covers cybersecurity, compliance, operational, and financial risk. Step three rates likelihood and impact across these four domains.
Can you trust a completed vendor questionnaire on its own?
No. A completed questionnaire is a starting point, so the record should also hold the step four rating reports or audit notes and the name of the Security/IT approver who signed them.
How to start with your highest-risk tier
Begin with the vendors that handle your most sensitive data. Name the approver for each gate, send the next renewal through that path, and set the record it leaves beside what your spreadsheet holds today. Once that holds, apply the same gates to the medium and low tiers.
