Skip to main content
Policy Authority
Category: Third-Party Risk

Vendor Risk Register

Also known as: Third-Party Risk Register, Supplier Risk Register
Simply put

A vendor risk register is a structured record that documents and tracks the risks an organization faces from working with its vendors and suppliers. It brings these risks together in one place so the organization can monitor them and respond in a coordinated way. It is a tool for keeping visibility over third-party risks rather than a process for assessing or treating them on its own.

Formal definition

A vendor risk register is a repository that identifies, documents, and tracks risks associated with vendors, suppliers, and other third parties across functions such as procurement, finance, and compliance. It typically consolidates the outputs of vendor risk assessments, processes that identify and evaluate potential risks arising from third-party relationships, into a single record that supports ongoing monitoring. As an artifact within a broader vendor risk management (VRM) program, the register supports, but does not by itself constitute, the assessment, treatment, and governance of third-party risk; its scope, fields, and rating conventions commonly vary by organization, sector, and jurisdiction. This entry does not address specific tooling, assessment methodologies, or implementation detail.

Why it matters

Organizations increasingly rely on vendors, suppliers, and other third parties across functions such as procurement, finance, and compliance, and each of those relationships can introduce risk. A vendor risk register matters because it consolidates these dispersed third-party risks into a single record, giving the organization a comprehensive snapshot from which it can maintain visibility and respond in a coordinated rather than fragmented way. Without such a record, risks identified in individual vendor assessments may remain siloed within the functions that raised them, limiting the organization's ability to see aggregate or concentrated exposure.

The register's value lies in supporting proactive rather than reactive monitoring. By bringing together the outputs of vendor risk assessments in one place, it enables ongoing tracking of known third-party risks over the life of each relationship, rather than treating assessment as a one-time exercise at onboarding. This is particularly relevant where vendor arrangements underpin critical operations or where compliance obligations attach to third-party conduct.

It is important to recognize the register's limits. A vendor risk register is an artifact, a record, not a process. It documents and tracks risk but does not, on its own, assess, treat, or govern it. Treating the existence of a register as evidence that third-party risk is being managed would be a common misuse; the register is only as useful as the assessment, treatment, and governance activities that populate and act upon it within a broader vendor risk management program.

Who it's relevant to

Risk Managers
Risk managers use the vendor risk register to maintain aggregate visibility over third-party exposures and to track identified risks over time. It supports their coordination of monitoring and response, though it does not replace the assessment and treatment processes they oversee within the broader VRM program.
Procurement and Vendor Management Teams
Because vendor risks span procurement functions, teams managing supplier relationships rely on the register to document risks arising at onboarding and throughout the relationship, and to keep those risks in a shared record rather than isolated within individual sourcing decisions.
Compliance Officers
Where compliance obligations attach to third-party conduct, compliance officers may draw on the register to track risks relevant to adherence with applicable laws, regulations, and internal policies. Applicable obligations vary by jurisdiction and sector.
Internal Auditors and Assurance Functions
Independent assurance providers may examine the register as evidence of how third-party risks are documented and tracked. Consistent with their independence, they evaluate the register and the management activities that populate it rather than owning or maintaining it themselves.

Inside Vendor Risk Register

Vendor identification and profile
Basic descriptive data for each third party, such as legal entity name, the business owner or relationship owner internally, the products or services provided, and the nature of the engagement. This anchors each entry to a specific relationship and typically supports downstream tiering.
Criticality or tiering classification
A categorization of how important or high-exposure a vendor is to the organization, often used to determine the depth and frequency of due diligence and monitoring. Criteria commonly include data access, business dependency, and substitutability, though specific thresholds vary by organization.
Identified risks
The specific risks associated with the vendor relationship, which may span domains such as information security, data privacy, financial stability, operational resilience, regulatory compliance, and concentration risk. The register records these rather than the broader risk assessment methodology itself.
Risk assessment ratings
Recorded ratings that may reflect inherent risk (before controls) and residual risk (after considering mitigating controls). These are distinct: inherent risk reflects exposure absent mitigation, while residual risk reflects the remaining exposure after controls are considered.
Controls and mitigations
The controls relied upon to treat identified risks, which may be operated by the vendor, by the organization, or contractually required. The register typically references these controls; it does not by itself test or provide assurance over their operating effectiveness.
Contractual and obligation references
Pointers to relevant contract terms, service levels, data protection clauses, right-to-audit provisions, and regulatory obligations tied to the relationship. What is contractually required varies by jurisdiction, sector, and negotiated terms.
Ownership and accountability
Assignment of a responsible owner for the relationship and, in many operating models, oversight by a second line function. This helps clarify who manages the risk versus who provides independent challenge or assurance.
Monitoring and review cadence
Records of assessment dates, next review dates, and ongoing monitoring activities. Review frequency is commonly aligned to vendor criticality rather than applied uniformly.
Status and remediation tracking
The current state of identified issues, open findings, agreed remediation actions, owners, and target dates. This turns the register into a living record rather than a point-in-time snapshot.

Common questions

Answers to the questions practitioners most commonly ask about Vendor Risk Register.

Is a vendor risk register the same as a list of approved vendors?
No. An approved vendor list records which suppliers an organization has authorized to engage, typically as an output of procurement or onboarding due diligence. A vendor risk register is a risk management artifact that captures identified risks associated with third-party relationships, along with their assessment and treatment. The two may draw on overlapping data, but they serve different purposes: one governs eligibility to transact, the other supports the ongoing identification, assessment, and treatment of uncertainty arising from those relationships.
Does maintaining a vendor risk register mean the associated risks are controlled or mitigated?
Not by itself. A register is a documentation and tracking mechanism; recording a risk does not treat it. Treatment depends on the controls, remediation actions, and monitoring applied by the accountable parties, and residual risk commonly remains even after treatment. The register may help make risk visible and support decisions, but it does not guarantee that any risk has been reduced or that controls are operating effectively.
Who should own and maintain the vendor risk register?
Ownership arrangements vary by organization. In many operating models aligned to the three lines model of the IIA, the business function or relationship owner that engages the vendor holds first line accountability for identifying and managing the associated risks, while a second line function such as procurement risk, vendor management, or compliance may coordinate the register, set methodology, and provide oversight. Internal audit, as a third line assurance function, typically reviews the register rather than maintaining it, to preserve independence. Specific roles should be defined in the organization's governance framework.
What information is commonly captured for each entry in a vendor risk register?
Entries commonly include an identifier for the vendor and the service, a description of the risk, the risk category (for example information security, financial, operational, or regulatory), an assessment of likelihood and impact, and where methodologies distinguish them, an indication of inherent and residual risk. Entries often also record assigned owners, existing controls, planned treatment actions, status, review dates, and links to supporting due diligence. The exact fields depend on the organization's risk assessment methodology and are not standardized across frameworks.
How often should entries in a vendor risk register be reviewed?
Review frequency is generally risk-based rather than fixed. Higher-criticality vendors, such as those handling sensitive data or supporting essential services, are commonly reviewed more frequently than lower-risk suppliers. Reviews may also be triggered by events such as contract renewal, a change in the service, an incident, or a change in the vendor's circumstances. Organizations typically define review cadences in their third-party risk management policy, and applicable regulatory expectations in some sectors and jurisdictions may influence these intervals.
How does a vendor risk register relate to the broader enterprise risk register?
A vendor risk register is typically a specialized register focused on third-party relationships, whereas an enterprise risk register captures risks to organizational objectives at a broader level. Some organizations aggregate or escalate significant vendor risks into the enterprise register so that material third-party exposures are visible to senior governance bodies. The relationship between the two, including thresholds for escalation, depends on the organization's risk management framework and reporting structure.

Common misconceptions

A vendor risk register provides assurance that vendor controls are operating effectively.
A register is a management record of identified risks, ratings, and controls relied upon. It documents what is expected or claimed; it does not independently test controls or provide assurance. Assurance over vendor controls typically comes from separate activities such as independent audits, third-party attestation reports, or testing performed by an assurance function, whose independence should be kept distinct from the management activity of maintaining the register.
The risk ratings in the register represent the organization's actual remaining exposure.
Ratings may capture inherent risk, residual risk, or both, and these are not interchangeable. Inherent risk reflects exposure before mitigation, while residual risk reflects exposure after controls are considered. A register that records only inherent ratings does not by itself show remaining exposure, and residual ratings depend on controls actually being in place and effective.
Maintaining a vendor risk register satisfies applicable third-party risk regulatory obligations.
A register is a tool that can support governance and oversight of third parties, but third-party risk expectations depend heavily on jurisdiction, sector, and organization size. The register itself does not constitute compliance; obligations, required due diligence, and oversight practices differ across regimes, and this entry does not provide legal advice on any specific requirement.

Best practices

Align the depth and frequency of assessment and monitoring to vendor criticality or tier, so that higher-exposure relationships receive more rigorous and more frequent review.
Record inherent and residual risk distinctly, and make clear which controls are relied upon to move from one to the other, so that ratings are not misread as guaranteed reduced exposure.
Assign a clear relationship owner for each entry and, where the operating model supports it, preserve the distinction between those who manage the risk and those who provide independent challenge or assurance.
Treat the register as a living record by tracking assessment dates, next review dates, open findings, and remediation actions with owners and target dates rather than as a point-in-time document.
Link entries to relevant contractual terms and applicable obligations, and confirm what is required in the relevant jurisdiction and sector rather than assuming requirements are universal.
Corroborate reliance on vendor controls with independent evidence, such as third-party attestation or assurance activities, rather than treating recorded controls as evidence of effective operation.
a promotional banner asking how ready are you for PCI DSS 4.0? With a call-to-action to get the checklist now.