Vendor risk management guides
Practical, framework-mapped guides to vendor due diligence for teams without a GRC department: how to inventory and tier third parties, what to ask them, how to score the answers, and what SOC 2, ISO 27001 and GDPR auditors expect to find in the file.
- Fundamentals
- Checklist
Vendor due diligence: a practical guide for small and mid-sized businesses
The end-to-end process — scoping, questionnaires, evidence, scoring, review cadence — sized for a team of one.
9 min read
- Questionnaires
- Scoring
Vendor risk assessment questionnaire: what to ask, and how to score the answers
The questions that matter by risk tier, mapped to the controls auditors recognise, with a scoring method you can explain.
8 min read
- Programme design
- SMB
Third-party risk management for small businesses: a programme without a GRC team
Enterprise TPRM assumes a department. This is the version for a company with none — and what it still must not skip.
7 min read
- SOC 2
- Audit
SOC 2 vendor management: what auditors expect from your third-party programme
CC9.2, subservice organisations, and the vendor evidence an auditor will sample. Prepare it before the fieldwork window.
7 min read
- ISO 27001
- Audit
ISO 27001 supplier relationships: meeting Annex A 5.19–5.23 with evidence
The five supplier controls in the 2022 edition, what each demands, and the records that satisfy them.
8 min read
- GDPR
- Privacy
GDPR processor due diligence: vetting vendors that handle personal data
Article 28 makes you accountable for your processors. Here is what 'sufficient guarantees' looks like in practice.
8 min read
- Checklist
- Onboarding
Vendor onboarding checklist: the checks to finish before the contract is signed
Twelve checks, grouped by who owns them, with the one record to keep for each so the file is audit-ready from day one.
7 min read
- Programme design
- Scoring
Vendor risk tiering: how to classify third parties and set a review cadence
Four tiers, three questions to assign them, and the review cadence each one earns — so effort goes where the risk is.
7 min read
The process in these guides, as a product
VendorVet is the vendor inventory, questionnaire, scoring and evidence record the guides describe — built for small and mid-sized businesses, free to start.