What it is
Vendor compliance is the practice of knowing the risk your suppliers carry and keeping it under review. The vendor register holds one row per supplier — its category, the data it touches, how critical it is to your operation, and its latest assessed risk band. A KPI band counts total vendors, active ones, the critical tier, those rated elevated risk, and how many reviews are due.
Your risk is not only your own — a supplier with poor controls or access to sensitive data is your exposure too. This surface lets a risk manager see the supply base at a glance, sort it by how critical each vendor is, and find the ones whose review cadence has passed or that have never been assessed. It turns third-party risk from an annual spreadsheet into a register you can actually work.
When to use it
- You are onboarding a new supplier and need to assess its risk
- A vendor handles sensitive data and you need to track it
- You want to see which vendors are overdue for review
- You are prioritising assessments by how critical a vendor is
- You need a supply-base risk picture for a board or assessor
How it works
Step by step.
- 1
Read the KPI band
The band counts total vendors, active, the critical tier, elevated-risk and reviews due — your supply-base posture at a glance.
- 2
Open the register
Each supplier is one row showing its category, the data it touches, its criticality tier and its latest inherent-risk band.
- 3
Sort by criticality
Group the register by tier — critical down to low — so the suppliers that matter most are in front of you first.
- 4
Find assessments due
The assessments-due view lists vendors past their review cadence, or never assessed, so nothing drifts unreviewed.
- 5
Assess a vendor
Work through a vendor’s assessment to set or refresh its risk band, then move to the next one that is due.
Worked example
Follow it through.
The scenario
You have engaged a new payroll-processing supplier that handles worker pay data and needs assessing.
- 1 Open the vendor register; the KPI band shows 3 reviews due.
- 2 Add the new payroll processor with category Payroll Services and data "worker pay and bank details".
- 3 Set its criticality to critical, since pay would stop if it failed.
- 4 Run its first assessment, which lands it in the elevated-risk band pending controls evidence.
- 5 Note it in the assessments-due list until the evidence is supplied.
The result
The new payroll supplier is on the register at critical tier with an elevated-risk band, and it sits in the assessments-due list until its controls are evidenced.
Tips & notes
Good to know.
- Criticality and risk are different axes — a low-risk vendor can still be critical if your operation stops without it.
- A vendor that has never been assessed is a blind spot, not a low risk; the assessments-due view surfaces both.
- Record the data a vendor touches accurately — it is the single biggest driver of how much its risk matters.
- Work the critical tier first when reviews pile up; a lapse there has the largest consequence.
When you’re done
Your suppliers are on a register with their criticality, data exposure and risk band, and the assessments that are due are visible and worked.