Tier vendors by the data they actually touch, turn questionnaires into scored data, and ingest vendor evidence on a schedule instead of chasing it by email.
50 min 210 XPSkills: Third-party risk, Automation, Evidence
Brief
Third-party risk is where manual GRC goes to die. A typical mid-size company has three hundred vendors, one shared inbox, and an annual questionnaire cycle that finishes just in time to be out of date. The output is a spreadsheet nobody trusts and a board slide that says 'managed'.
The engineering answer is the same as everywhere else in this track: make the population queryable, make the assessment proportional to actual exposure, and make evidence arrive on a schedule instead of by chase email.
You cannot assess three hundred vendors deeply. You can assess thirty deeply: if your tiering is honest about which thirty.
Tier by data, not by spend
Tiering decides how deep each assessment goes, and the honest axis is data access: what does this vendor hold, and what happens when it leaks. Procurement prefers tiering by spend because spend is already in their system. Spend is a terrible proxy: the office plant app costs nothing and holds nothing; the three-thousand-dollar support tool holds a support inbox full of customer screenshots.
Once tiers exist, depth follows: Tier 1 vendors get continuous monitoring and annual evidence review, Tier 2 get a scoped questionnaire, Tier 3 get a self-attestation and a re-tier trigger. Anything deeper for Tier 3 is time stolen from Tier 1.
Assessment depth follows the tier, and the tier follows the data, not the invoice.
Questionnaires are data pipelines
A questionnaire sent as a Word attachment returns as a Word attachment, and the answers rot in email. Modelled as data, the same questionnaire is versioned YAML, scored by declared rules, ingested through an API, and stored in a register you can query. The payoff is not speed: it is the delta: when a vendor's answer changes from 'MFA enforced' to 'MFA optional', a pipeline notices the same week. A spreadsheet notices never.
Vendor-side evidence works the same way. A SOC 2 report is an artefact with an issue date and a period; treating it as a permanent green badge is the classic failure. The register must know when each piece of evidence stops being fresh.
The questionnaire is the input. Delta detection is the point.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: Four hundred vendors, one questionnaire
Scenario sim+70 XP
Read the brief and answer both questions.
Incident brief
Procurement is proud of their new third-party risk process: every one of the company's 400 vendors now receives the same 280-question SIG questionnaire annually. 'Everyone gets the same rigour,' the procurement lead says. 'Tiering vendors would be unfair, and anyway, we tier by contract value, so the big spenders get the closest look.'
Among the 400: a payroll provider holding every employee's bank details ($40k/yr), a support desk tool full of customer screenshots ($3k/yr), and an office plant watering service ($60k/yr, no systems access). The plant service is in the top tier by spend. The support desk tool is in the bottom tier.
1.1What should decide how deep a vendor assessment goes? (two words)
1.2What is the name for the risk a vendor presents before any of your controls are applied? (two words)
Task 2: Scored by hand, trusted by no one
Scenario sim+70 XP
Read the brief and answer both questions.
Incident brief
A GRC analyst scores returned questionnaires in Excel. Each answer gets 1 to 5 'based on how it reads'. When a vendor's score drops, she adjusts it back up 'if they've been responsive lately'. The CISO asks why Vendor X's risk score fell 40 points this quarter and nobody can reconstruct it: the scoring lived in a copy of a copy of a spreadsheet.
Meanwhile, a vendor quietly changed an answer from last year: 'encryption at rest: yes' became 'encryption at rest: roadmap'. Nobody noticed, because last year's return is a PDF in a shared drive.
2.1What should replace hand-assigned scores so a score is reproducible? (two words)
2.2What capability would have caught the encryption answer changing year over year? (two words)
Task 3: The SOC 2 that expired in March
Scenario sim+70 XP
Read the brief and answer both questions.
Incident brief
Your vendor register shows a green checkmark next to every Tier 1 vendor: 'SOC 2 on file'. The auditor asks about CloudVault, your largest data processor. The report on file covers a period ending fourteen months ago and the bridge letter nobody requested is three months overdue. The checkmark is still green because the column only records whether a file exists, not whether it covers now.
The register owner pushes back: 'We have the document. That's the control.'
Procurement wants every vendor to get 'the full questionnaire, to be safe'. That includes the office plant service and the payroll provider in the same workflow. Meanwhile the register marks vendors green when a file exists, regardless of age.
Write the intake specification the pipeline will run: tiering driven by data access, scoring by declared rules, evidence ingested on a schedule with a freshness window, and delta detection against the previous return.
Current process (as described by procurement)
process: annual questionnaire
scope: all 400 vendors, identical questionnaire
tiering: by annual contract value
scoring: analyst judgement, 1-5, "how it reads"
evidence: "SOC 2 on file (yes/no)"
recertification: "when someone remembers"
1
2
3
4
5
6
7
8
9
10
11
12
Checks
Tiering follows data access, not spend
Questionnaire depth varies by tier
Scoring is declared rules, not judgement
Evidence arrives via API or scheduled feed
Evidence expires after a stated window
Year-over-year answer changes raise an alert
A trigger exists for moving a vendor between tiers
Six vendor register records are up for annual review. The vendor manager insists they are all fine because 'every vendor answered the questionnaire'.
Answering is not the bar. Accept the records a pipeline can actually operate; reject the ones that encode a manual, unverifiable process.
Verdicts are accept or reject. Every rejection needs one reason code from: wrong-tiering-axis | judgement-scoring | stale-evidence | no-delta-detection.
vendor register records (field summary)
V-1 tier: data-access | scoring: declared rules | evidence: api feed, 90-day freshness | delta: on
V-2 tier: annual contract value | scoring: declared rules | evidence: api feed, 90-day freshness | delta: on
V-3 tier: data-access | scoring: "analyst rates 1-5 by feel" | evidence: api feed | delta: on
V-4 tier: data-access | scoring: declared rules | evidence: "SOC 2 on file (yes/no)" | delta: on
V-5 tier: data-access | scoring: declared rules | evidence: api feed, 90-day freshness | delta: answers diffed year over year
V-6 tier: data-access | scoring: declared rules | evidence: api feed | delta: "vendors re-attest annually in full"
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Checks
Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code
Next on your path · Data & Evidence
Fourth-Party & Supply-Chain Visibility
Your vendors have vendors. Map subprocessors, convert contract clauses into testable controls, and monitor the chain you cannot see.
