Vendor risk management: What to watch for and best practices

Key takeaways:

• Vendor risk management involves the ongoing monitoring of third-party supplier risks and employing appropriate risk-mitigation measures.
• Financial risk, operational risk, reputational risk, compliance risk, market risk, natural disaster risk, man-made risk, geopolitical risk, and cybersecurity risks are some of the most common types of vendor risks.
• The four steps of implementing a successful risk management program are including a risk evaluation phase in the buying process, creating a risk profile for your vendors, evaluating potential vendor risks, and minimizing or mitigating them.
• Some vendor risk management best practices include things like making risk assessment a recurring exercise, being mindful of risks posed by your growing SaaS stack, and more.

The need for vendor risk management is expanding. As purchasing power is democratized, there is inadequate attention on the risks posed by the SaaS stack. Stakeholders in a hurry to purchase a SaaS subscription to meet their daily needs often overlook potential breaches and supplier risks. 

As a result, the vendor risks begin to fester and grow. This could result in many security risk incidents ranging from your SaaS supplier going bankrupt to your sensitive data being exposed. Nearly 40% of the SaaS stack is unmanaged in most organizations, paving the way for data leak incidents.

To prevent supplier risk disruptions, organizations need to clearly understand the nature of potential risks, the steps involved in creating a vendor risk management program, and the best practices for prevention.

What is vendor risk management?

Vendor risk management (VRM) is the process of monitoring, spotting, evaluating, and minimizing risks associated with your tech stack’s third-party vendors. A VRM process is all about conducting regular due diligence exercises that help you understand the risks that your SaaS suppliers expose you to. 

Failing to have a vendor risk management program can make you vulnerable to a third-party security breach or technical failure, which may harm or disrupt your business. Identifying and mitigating potential risks with a vendor risk management plan will not only help prevent expensive disruptions but also will ensure business continuity.

Types of risks that you need to watch out for

Now that you know the importance of having a vendor risk management program in place, you can't just dive head-first into creating one. You need to understand the types of risks that you are up against. Only when you identify and assess your vendor risks appropriately will you be able to tackle them head-on. 

Listed below are some of the common vendor risk categories.

1. Financial risk

When you rely on small cloud providers, you are exposing yourself to the risk of their financial stability. When Nirvanix, one of the pioneers in cloud-based storage went out of business, customers only had two weeks to get their data and move out. 

Nirvanix, despite being strong technically, couldn’t compete with big cloud providers like Amazon and went out of business. If the same happens to your SaaS provider, you would be exposed to a harrowing experience where you are left scrambling to find another alternative and move all your data in a short interval.  

2. Operational risk 

Although you have a SaaS downtime clause in your master services agreement, sometimes outages may appear out of the blue. If it’s possible for large SaaS suppliers like Salesforce to experience multi-day service outages, think of your small SaaS provider who runs with a small tech team. There may come a time when they lose the capacity to stop the outage in a timely manner, so you should have a backup plan in place to weather such instances.  

3. Reputational risk

Sometimes your suppliers may indulge in activities that may leave a negative perception of your brand. It could be anything from using pirated software to ill-treating their employees, their behavior may end up shedding a negative light on your brand just because of your customer-supplier relationship.

4. Compliance risk 

Compliance means much more than fulfilling minimal obligations for data security and reporting. Today, the compliance landscape is ever-evolving. You never know when the government will require new regulations, similar to HIPAA and GDPR. In addition to ensuring that your team fulfills these obligations, you will have to make sure that your suppliers are compliant as well in order to stay on the right side of regulatory changes.

5. Market risk 

Sometimes, changes in the market climate or economic conditions may affect your customer-supplier relationship. For instance, let’s assume that owing to evolving market climates your organization decides to move from marketing-led growth to a product-led growth model. 

Marketing operations for this model would be drastically different from your previous months, and you may need a lot of features and functionalities that your SaaS vendor might not offer. And, in some cases, your SaaS vendor might change the direction of their platform to keep up with evolving customer needs, but those changes may not suit your company. 

6. Natural disaster risk  

The occurrence of a natural disaster may hinder your supplier’s ability to continue their services. Suppliers who have data centers located in the Gulf area may be prone to hurricanes. Your Asian suppliers may be susceptible to floods, earthquakes, or even tsunamis. Such occurrences may lead to service outages.

7. Man-made risk 

There are chances that man-made risks, like fires or explosions, may affect your vendor’s ability to deliver promised services. However, it is imperative to note that not all fire accidents happen due to deliberate negligence. One example of this type of risk is  the fire at OVHcloud’s data centres, which caused nearly 2% of .FR domains to go down. While the cause of the fire has not been disclosed yet, it was fortunate that OVHcloud had a disaster recovery plan in place.

8. Geopolitical risk 

Global political events like civil unrest or terrorism may affect your vendor’s operations. Such instances increase the chances of forced outages and high staff turnover, affecting your supplier’s ability to offer its services.

9. Cybersecurity risk

Data breaches and information security are top of mind for many organizations today. If one of your supplier’s employees expose your company’s data to a phishing attack or ransomware, it may pave the way for a security breach, compromising your sensitive information. 

4 steps to implement a vendor risk management program

If you’re new to vendor risk management, it may seem daunting. However, you can implement and streamline a vendor risk management strategy if you know what you are looking for. Here are four steps that every vendor risk management process must include.

1. Include risk evaluation in your buying process 

One element of your risk management strategy should be to incorporate a risk evaluation phase in your SaaS buying process. Before you choose a vendor, you need to thoroughly vet them. Making risk assessment a mandatory step may help spot and prevent potential risks beforehand. 

2. Create a risk profile for your suppliers

The second step of your vendor risk management program is mapping your SaaS stack and creating a risk profile for each supplier where you identify potential risks. A vendor risk assessment matrix will help you categorize your vendors based on the risks they pose. 

In addition to helping you categorize vendors, a risk assessment matrix will help you spot critical risks at a glance. These profiles will also help you determine the questionnaires that you need to ask your suppliers to fill out so that you can dig in deeper and get a better understanding of the risks they expose you to.

3. Evaluate your risks

Now that you have defined key risk categories, the next step is to assess your risks with metrics like key performance indicators. It is advisable to track changes and trends in these KPIs. Vendor credit rating, delivery performance metrics, economic volatility, and sustainability factors are some of the KPIs you need to include in your vendor risk scorecards. 

4. Minimize and mitigate risks

Now that you have a clear idea of what risks you are up against, you are free to devise a plan to minimize and mitigate those risk factors. For instance, if your suppliers have data centers in areas that are prone to natural disasters, then it would be wise to apply for business interruption insurance or have an alternate SaaS vendor ready.

Take the time to develop an action plan that takes care of all your risks — from business continuity to information technology and healthcare regulatory compliance. Action plans are either preventive or reactive. While preventive risk mitigation plans offer measures to prevent a situation altogether, reactive plans provide a blueprint for how to respond in the event of a breach or other business disruption. 

Vendor risk management best practices

In addition to implementing a vendor risk management process, you need to know the best practices and implement them to get the most out of your vendor risk management program. Here are five vendor risk management best practices to keep in mind.

1. Don’t focus all your efforts on just your top vendors 

Some organizations follow the Pareto principle to the tee, and only focus on SaaS vendors who take up 80% of their spend. While it is good to focus on areas where the disruption will leave a severe impact, it is imperative to consider all active vendors. 

Also, don’t let past vendor relationships misguide you. Although long-term vendor relationships have a comparatively lower risk, they are not completely risk-free. Over the years, people at your vendor organization’s helm may change and so will their strategy. If that is the case, you never know when one of their internal strategies may increase your risk. For instance, your vendor's new outsourcing strategy can result in a compliance risk for you if the fourth-party risk is not considered.

2. Make risk assessment a recurring exercise

Don’t treat vendor risk assessment as a one-time exercise. While it is great to assess your SaaS vendor's capability in the onboarding process with a SaaS security checklist, you need to make it a practice to evaluate vendors at regular intervals. You never know when your vendor may get into financial trouble or labor disputes. When your vendor monitoring program operates at a regular frequency, you will be prepared for the worst.

3. Keep a close eye on your suppliers

Every employee will be focused on doing what’s in their company’s best interest, and so you cannot rely on your point of contact to share potential risks with you candidly. Sometimes, your point of contact may not be aware of significant operational risks themselves. So, keep an eye on your vendors using multiple avenues like Google Alerts, social media handles, and more. 

4. Have a back-up plan in place

You never know when your potential vendor risk may become a reality. So, it is always better to have back-up plans in place. A disaster recovery plan isn’t enough. Always keep current data back-ups and have alternative SaaS vendors ready just in case you need to make a quick replacement.. 

5. Be mindful of risks posed by your growing SaaS stack

As your organization continues to grow, so will your SaaS stack. Sometimes, even having a dedicated team to monitor and mitigate vendor risks may not be enough. During this time, it is better to leave risk mitigation operations to the experts and outsource the entire process altogether. 

Build a risk-aware organization

Whether you are just implementing a VRM program or looking for ways to improve your existing process, the key to a successful vendor risk management strategy is awareness. Monitor your suppliers regularly and identify risk factors earlier in the game to ward off unpleasant surprises. 

A key component of an ideal vendor risk management process is solid vendor relationship management. Your SaaS procurement team needs to work in tandem with your suppliers. As your SaaS stack continues to grow, there may come a point where your SaaS vendor management may become overwhelming. 

Are you having trouble keeping track of your SaaS suppliers? Contact Vendr today to see how effortless SaaS management can be.