Proactively Identify and Mitigate Vendor Risk

Do not fill in this field

Enter no text in this field

Get Instant Access
to This Blueprint

Business Email

Full Name

Company

Phone

Job Title

IT priorities are focused on daily tasks, pushing risk management to secondary importance and diverging from a proactive environment.
IT leaders are relying on an increasing number of third-party technology vendors and outsourcing key functions to meet the rapid pace of change within IT.
Risk levels can fluctuate over the course of the partnership, requiring manual process checks and/or automated solutions.

Our Advice

Critical Insight

Every IT vendor carries risks that have business implications. These legal, financial, security, and operational risks could inhibit business continuity and IT can’t wait until an issue arises to act.
Making intelligent decisions about risks without knowing what their financial impact will be is difficult. Risk impact must be quantified.
You don’t know what you don’t know, and what you don’t know, can hurt you. To find hidden risks, you must use a structured risk identification method.

Impact and Result

A thorough risk assessment in the selection phase is your first line of defense. If you follow the principles of vendor risk management, you can mitigate collateral losses following an adverse event.
Make a conscious decision whether to accept the risk based on time, priority, and impact. Spend the required time to correctly identify and enact defined vendor management processes that determine spend categories and appropriately evaluate potential and preferred suppliers. Ensure you accurately assess the partnership potential.
Take a proactive stance against IT threats and vulnerabilities by identifying and assessing IT’s most significant risks before they happen.

Proactively Identify and Mitigate Vendor Risk Research & Tools

Start here – read the Executive Brief

Read our concise Executive Brief to find out how to create a vendor risk management program that minimizes your organization’s vulnerability and mitigates adverse scenarios.

Proactively Identify and Mitigate Vendor Risk – Executive Brief

1. Review vendor risk fundamentals and establish governance

Review IT vendor risk fundamentals and establish a risk governance framework.

2. Assess vendor risk and define your response strategy

Categorize, prioritize, and assess your vendor risks. Follow up with creating effective response strategies.

3. Monitor, communicate, and improve IT vendor risk process

Assign accountability and responsibilities to formalize ongoing risk monitoring. Communicate your findings to management and share the plan moving forward.

Member Testimonials

After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve. See our top member experiences for this blueprint and what our clients have to say.

Client

Experience

Impact

$ Saved

Days Saved

Testimonial

Tenneco

Guided Implementation

9/10

$95,000

Aidle is an awesome resource for InfoTech. Thank you.

University of Wisconsin-Madison

Guided Implementation

9/10

$1,229

I enjoyed the conversation and introduction to the tool's use. Steven's insight and auditing experience was helpful.

San Manuel Band of Mission Indians

Guided Implementation

10/10

N/A

Workshop: Proactively Identify and Mitigate Vendor Risk

Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

Module 1: Prepare for the Workshop

The Purpose

To prepare the team for the workshop.

Key Benefits Achieved

Avoids delays and interruptions once the workshop is in progress.

Activities

Outputs

1.1

Send workshop agenda to all participants.

All necessary participants assembled

1.2

Prepare list of vendors and review any contracts provided by them.

List of vendors and vendor contracts

1.3

Review current risk management process.

Understanding of current risk management process

Module 2: Review Vendor Risk Fundamentals and Establish Governance

The Purpose

Review IT vendor risk fundamentals.
Assess current maturity and set risk management program goals.
Engage stakeholders and establish a risk governance framework.

Key Benefits Achieved

Understanding of organizational risk culture and the corresponding risk threshold.
Obstacles to effective IT risk management identified.
Attainable goals to increase maturity established.
Understanding of the gap to achieve vendor risk readiness.

Activities

Outputs

2.1

Brainstorm vendor-related risks.

2.2

Assess current program maturity.

Vendor risk management maturity assessment

2.3

Identify obstacles and pain points.

2.4

Develop risk management goals.

Goals for vendor risk management

2.5

Develop key risk indicators (KRIs) and escalation protocols.

2.6

Gain stakeholders’ perspective.

Stakeholders’ opinions

Module 3: Assess Vendor Risk and Define Your Response Strategy

The Purpose

Categorize vendors.
Prioritize assessed risks.

Key Benefits Achieved

Risk events prioritized according to risk severity – as defined by the business.

Activities

Outputs

3.1

Categorize vendors.

3.2

Map vendor infrastructure.

3.3

Prioritize vendors.

Vendors classified and prioritized

3.4

Identify risk contributing factors.

3.5

Assess risk exposure.

Vendor risk exposure

3.6

Calculate expected cost.

Expected cost calculation

3.7

Identify risk events.

3.8

Input risks into the Risk Register Tool.

Module 4: Assess Vendor Risk and Define Your Response Strategy (continued)

The Purpose

Determine risk threshold and contract clause relating to risk prevention.
Identify and assess risk response actions.

Key Benefits Achieved

Thorough analysis has been conducted on the value and effectiveness of risk responses for high-severity risk events.
Risk response strategies have been identified for all key risks.
Authoritative risk response recommendations can be made to senior leadership.

Activities

Outputs

4.1

Determine the threshold for (un)acceptable risk.

Thresholds for (un)acceptable risk

4.2

Match elements of the contract to related vendor risks.

4.3

Identify and assess risk responses.

Risk responses

Module 5: Monitor, Communicate, and Improve IT Vendor Risk Process

The Purpose

Communicate top risks to management.
Assign accountabilities and responsibilities for risk management process.
Establish monitoring schedule.

Key Benefits Achieved

Risk monitoring responsibilities are established.
Transparent accountabilities and established ongoing improvement of the vendor risk management program.

Activities

Outputs

5.1

Create a stakeholder map.

Stakeholder map

5.2

Complete RACI chart.

Assigned accountability for risk management

5.3

Establish the reporting schedule.

Established monitoring schedule
Risk report

5.4

Finalize the vendor risk management program.

Vendor Risk Management Program Manual

About Info-Tech

Info-Tech Research Group is the world’s fastest-growing information technology research and advisory company, proudly serving over 30,000 IT professionals.

We produce unbiased and highly relevant research to help CIOs and IT leaders make strategic, timely, and well-informed decisions. We partner closely with IT teams to provide everything they need, from actionable tools to analyst guidance, ensuring they deliver measurable results for their organizations.

What Is a Blueprint?

A blueprint is designed to be a roadmap, containing a methodology and the tools and templates you need to solve your IT problems.

Each blueprint can be accompanied by a Guided Implementation that provides you access to our world-class analysts to help you get through the project.

Table of Contents

Need Extra Help?
Speak With An Analyst

Get the help you need in this 3-phase advisory process. You'll receive 4 touchpoints with our researchers, all included in your membership.

Guided Implementation 1: Review vendor risk fundamentals and establish governance

Call 1: Review vendor risk fundamentals
Call 2: Establish a risk governance framework

Guided Implementation 2: Assess vendor risk and define your response strategy

Call 1: Assess vendor risk and define your response strategy

Guided Implementation 3: Monitor, communicate, and improve vendor risk process

Call 1: Monitor, communicate, and improve vendor risk process

Authors

Scott Bickley

Melody Peng

Aadil Nanji

Contributors

Daniel J. Enneking, Founder, Strategic Procurement Partners
Donald H. Hopkins, Adjunct Assistant Professor, Wright State University in the College of Business
Deepak Bansal, Director Vendor Performance Relationship, Management, Willis Towers Watson
Steve Jeffery, First Vice President Strategic Sourcing, SunTrust