Skip to main content
Policy Authority
Category: Third-Party Risk

Vendor Segmentation

Also known as: Supplier Segmentation
Simply put

Vendor segmentation is the process of sorting an organization's suppliers into distinct groups based on criteria such as how much is spent with them, how critical they are to operations, and how much risk they present. Grouping vendors this way helps a business decide where to focus its limited time and resources, applying more attention to the suppliers that matter most. It is a way of organizing supplier relationships rather than a guarantee of any particular outcome.

Formal definition

Vendor segmentation is the practice of allocating suppliers into defined categories according to criteria commonly including spend volume, strategic importance, criticality, risk exposure, and performance. The resulting segments typically inform differentiated management approaches, such as the level of due diligence, monitoring intensity, and relationship investment applied to each group, enabling proportionate allocation of finite resources. As a risk-informed governance activity within third-party or supplier management, segmentation supports risk assessment and treatment decisions but does not itself constitute a control; its value depends on the accuracy of the criteria and data used and on how the segments are subsequently acted upon. This entry does not address specific segmentation models, tooling, or implementation methodology.

Why it matters

Most organizations work with far more suppliers than they can realistically scrutinize with equal intensity. Vendor segmentation matters because it provides a structured basis for directing finite due diligence, monitoring, and relationship-management resources toward the suppliers that carry the greatest spend, criticality, or risk exposure. Without such prioritization, oversight tends to be spread thinly and uniformly, leaving high-consequence relationships under-managed while low-consequence ones absorb disproportionate effort.

By grouping suppliers according to criteria such as spend volume, strategic importance, criticality, risk, and performance, segmentation enables a proportionate approach: more demanding assessment and closer ongoing attention for the groups that matter most, and lighter-touch handling for the rest. This supports better-informed risk assessment and treatment decisions across the third-party portfolio and helps governance functions justify how oversight resources are allocated.

It is important to recognize the limits of the practice. Segmentation is an organizing and risk-informed governance activity, not a control in itself, and it does not guarantee any particular outcome. Its usefulness depends on the accuracy of the underlying criteria and data and, critically, on how the resulting segments are actually acted upon; a segmentation model that is not reflected in differentiated management effort delivers little value.

Who it's relevant to

Third-party risk managers
Those responsible for managing supplier risk use segmentation to prioritize where deeper due diligence and closer monitoring should be focused, directing finite resources toward suppliers with the greatest criticality or risk exposure.
Procurement and supplier management teams
Procurement functions rely on segmentation to distinguish strategic and high-spend relationships from lower-consequence ones, informing how much relationship investment and management attention each group receives.
Governance professionals
Those overseeing third-party governance benefit from segmentation as a structured, risk-informed basis for allocating oversight resources proportionately and for demonstrating how that allocation is justified across the supplier portfolio.
Internal auditors and assurance providers
Assurance functions may examine whether segmentation criteria and underlying data are sound and whether the resulting segments are actually reflected in differentiated management activity, while remaining independent of the management processes they evaluate.

Inside Vendor Segmentation

Segmentation Criteria
The defined attributes used to group vendors, which commonly include the criticality of the goods or services provided, the nature and sensitivity of data accessed, spend or contract value, and the potential operational impact of a vendor's failure. Criteria typically vary by organization and sector.
Risk Tiers
The categories or bands into which vendors are placed, often labeled as high, medium, or low (or an equivalent tiering scheme). Tiers are intended to align the depth of due diligence, contractual controls, and ongoing monitoring with the assessed level of risk a vendor presents.
Differentiated Due Diligence and Monitoring
The practice of applying more rigorous assessment and more frequent monitoring to higher-tier vendors, and proportionately lighter treatment to lower-tier vendors. This links segmentation outcomes to actual risk treatment activities rather than treating all vendors identically.
Governance and Ownership
The roles, decision rights, and accountability for assigning and approving vendor tiers. Segmentation typically sits within a broader third-party risk management program, where management (first line) performs the segmentation and second-line functions may set methodology and provide oversight.
Periodic Reassessment
The recurring review of a vendor's assigned segment, since criticality, data access, and dependency can change over the life of a relationship. Reassessment triggers may be scheduled or event-driven, such as a change in scope or a significant incident.

Common questions

Answers to the questions practitioners most commonly ask about Vendor Segmentation.

Is vendor segmentation the same as vendor risk assessment?
No. Vendor segmentation is the practice of grouping third parties into tiers or categories, commonly based on criticality, spend, data access, or risk exposure, so that oversight effort can be prioritized proportionately. Risk assessment is the evaluation of the specific risks a given vendor presents. Segmentation typically informs how much assessment and ongoing due diligence a vendor receives, but it does not replace the assessment itself. A high-tier classification generally triggers more rigorous assessment rather than substituting for it.
Does placing a vendor in a lower tier mean it carries no risk and can be ignored?
No. Lower-tier classification generally indicates lower assessed criticality or exposure relative to other vendors, not the absence of risk. Vendors in lower tiers may still warrant baseline due diligence, contractual controls, and periodic review. Segmentation is intended to allocate oversight proportionately, not to remove certain vendors from the scope of third-party risk management entirely. Circumstances can also change, so tiering is typically revisited over time.
What criteria are commonly used to segment vendors into tiers?
Organizations commonly consider factors such as the criticality of the service to operations, access to sensitive or regulated data, integration with core systems, financial spend, regulatory or reputational exposure, and the difficulty of substituting the vendor. The specific criteria and their weighting typically vary by organization, industry, and jurisdiction, and the chosen factors are usually documented so classifications can be applied consistently and defended.
How often should vendor segmentation be reviewed and updated?
Segmentation is typically reviewed on a defined cycle and also upon trigger events, such as a change in the services provided, new data access, a material incident, a contract renewal, or a change in regulatory obligations. Review frequency often differs by tier, with higher-tier vendors reviewed more frequently. The appropriate cadence generally depends on the organization's risk appetite and any applicable regulatory expectations.
How does vendor segmentation relate to the level of due diligence performed?
Segmentation commonly drives a tiered due diligence model, in which higher-tier vendors receive more extensive assessment, documentation requirements, and ongoing monitoring, while lower-tier vendors may receive a proportionate baseline. The intent is to align the depth and frequency of oversight activities with assessed risk. The specific requirements assigned to each tier are typically defined in a third-party risk management policy or standard.
Who is typically responsible for maintaining vendor segmentation within a three lines model?
In many organizations, first line functions that own the vendor relationship apply and maintain the segmentation according to established criteria, while a second line function, such as procurement risk or vendor risk management, may set the methodology and provide oversight or challenge. Internal audit, as a third line assurance function, may independently evaluate whether segmentation is applied consistently and effectively, without owning or performing the classification itself. Specific role allocation varies by organization.

Common misconceptions

Vendor segmentation is the same as a full vendor risk assessment.
Segmentation is typically a triage step that groups vendors by relative risk to determine the appropriate level of scrutiny. It informs, but does not replace, the more detailed due diligence and risk assessment applied to individual vendors, particularly those in higher tiers.
A vendor's tier is fixed once assigned.
Segmentation is commonly treated as dynamic. A vendor's criticality, data access, or operational impact can change, so tiers are generally subject to periodic and event-driven reassessment rather than remaining static.
Spend or contract value alone determines a vendor's tier.
While spend can be one input, segmentation in many programs weighs multiple factors such as data sensitivity, service criticality, and potential operational impact. A low-spend vendor with access to sensitive data may warrant a higher tier than a high-spend, low-risk supplier.

Best practices

Define segmentation criteria explicitly and document the rationale, weighting, and thresholds so that tier assignments are consistent, defensible, and repeatable across vendors.
Base tiering on multiple risk dimensions, such as service criticality, data sensitivity, and operational impact, rather than relying on a single factor like spend.
Align the depth of due diligence, contractual controls, and monitoring frequency to each tier so that effort is proportionate to assessed risk.
Assign clear ownership and approval rights for segmentation decisions within the third-party risk management program, keeping management responsibilities distinct from any independent oversight.
Reassess vendor tiers on a defined schedule and in response to material changes, such as expanded data access or a significant incident.
Review the segmentation methodology itself periodically to confirm the criteria and thresholds remain appropriate as the organization's risk profile and obligations evolve.
Promotional banner graphic asking if you are ready for PCI DSS 4.0 with a call-to-action to get the guide