Third-party assessments: what changes when review time shrinks?

TL;DR: Third-party risk reviews can still take one to two months when teams rely on 200-question questionnaires, spreadsheets, and manual follow-up, according to Safe Security, even as vendor portfolios grow toward 100 essential third parties. The control problem is not assessment depth but workflow design: tiering, automation, and evidence handling now decide whether governance scales.

Editorial analysis by NHI Mgmt Group, based on content published by Safe Security: “From Months to Weeks: How a Manufacturer Cut Vendor Risk Assessments to Less than 2 Weeks”.

By the numbers:

• The team managed about 90–100 third parties in a single view of exposure scores, findings, and remediation.

Key questions

Q: How should organisations tier third-party vendors for risk reviews?

A: Tier vendors by the data they handle, the systems they can reach, and whether operations depend on them.

Q: What breaks when vendor assessments rely on questionnaires instead of access evidence?

A: They break at the point where paper controls diverge from actual exposure.

Q: How can security teams know whether third-party risk management is working?

A: Look for evidence that inventory, review, monitoring, and revocation are all connected.

Practitioner guidance

• Tier vendors by data access and operational dependency Use a plain-language intake model that separates high, medium, and low exposure based on whether the vendor handles restricted data, has internal access, or supports operations.
• Automate follow-ups and reminders before expanding the questionnaire Remove the manual chasing that consumes analyst time by routing reminders, escalations, and status updates through workflow logic rather than email threads.
• Create one governed vendor risk register Keep exposure scores, findings, remediation status, and escalation notes in a single record so leadership decisions reflect the same evidence set.

Bottom line: Third-party risk is failing when review depth depends on manual admin rather than a defensible tiering model.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →