How to run a vendor risk assessment your examiners can follow.

What to assess

Six factors that shape vendor risk

The process

Six steps from inventory to documented decision

1. 1

   Build the inventory

   List every vendor with its services, owner, contacts and the data and systems it touches.

2. 2

   Assign a risk tier

   Your firm applies its own criteria to rate each vendor; the tier sets review depth and frequency.

3. 3

   Run due diligence

   Send a questionnaire, collect evidence, and record dated review notes and findings.

4. 4

   Review the contract

   Check key clauses against your requirements and record what is present, missing or in negotiation.

5. 5

   Decide and document

   Your authorized reviewer records the outcome, accepted risks and any remediation with owners and due dates.

6. 6

   Monitor and repeat

   Track expiring documents, incidents and the next review date so the assessment stays current.

ThirdNexa does the reading, chasing and paperwork: questionnaires, evidence collection, cited contract review, reminders and an activity history. Your firm sets the criteria, assigns the tier and records every decision — the software never labels a vendor approved.

Common questions

Vendor risk assessment FAQ

How often should an RIA reassess a vendor?

Often enough to match the vendor's risk. Higher-risk vendors — those touching client nonpublic information or critical functions — are commonly reviewed annually; lower-risk vendors can follow a longer cycle. Your firm sets the frequency, and ThirdNexa tracks the next review date and reminds you before it lapses.

Which vendors belong in the assessment inventory?

Any third party that supports your business: custodians, portfolio management and reporting platforms, IT and cloud providers, outsourced compliance or trading support, marketing tools, and even office services with access to sensitive information. Start from your contracts and accounts-payable list, then see how RIAs keep a vendor inventory exam-ready.

Does Regulation S-P require vendor oversight?

Regulation S-P's safeguards rule expects firms to oversee service providers that receive customer information, including incident-notification provisions. The amended rule's compliance dates were December 3, 2025 for larger firms and June 3, 2026 for smaller firms. Our Regulation S-P vendor oversight guide walks through what that oversight looks like in practice, and Compliance & regulations lists the other frameworks we cover. This is educational information, not legal advice — your counsel determines how the rule applies to your firm.

What evidence should we collect during due diligence?

Commonly: SOC reports or equivalent security attestations, written policies, penetration-test summaries, insurance certificates, financial-stability indicators, and answers to a vendor due-diligence questionnaire. Keep each item dated, with a note recording who reviewed it and what your firm concluded.

Can software decide whether a vendor is approved?

No — and it shouldn't. Software can collect evidence, flag gaps, track dates and organize the record, but the decision to engage, conditionally approve or decline a vendor belongs to your firm's authorized reviewer. ThirdNexa never labels a vendor approved; your firm records every decision. See the controls that keep decisions with your firm.

What should we show an examiner who asks about vendor oversight?

A current vendor inventory with risk tiers, dated due-diligence evidence, contract review notes, recorded decisions with the reviewer's name, open findings with owners and due dates, and an activity history showing ongoing monitoring. ThirdNexa exports this record as an evidence pack — see the full oversight workflow.