The Mistake
Sending a generic security questionnaire to every supplier once a year and filing the response. This is checkbox compliance, and auditors know it.
Why It Fails
•Questionnaire responses are often aspirational, not factual
•One-size-fits-all ignores actual risk differences
•Annual review cycles miss changes in supplier risk profile
•No verification means no assurance
What to Do Instead
1. Classify Suppliers by Risk
Not all suppliers are equal. A cloud hosting provider with access to production data is very different from an office supplies vendor.
2. Tailor Your Approach
•Critical suppliers Detailed assessment, contract clauses, regular review, right to audit
•Standard suppliers Simplified assessment, standard contract terms
•Low-risk suppliers Basic due diligence, standard terms
3. Focus on What Matters
Key questions for critical suppliers:
•Do they have ISO 27001 or SOC 2?
•What data do they access or store?
•What happens if they have a breach?
•Can you audit them if needed?
4. Monitor Continuously
Don't wait for annual reviews. Track:
•Security incidents involving suppliers
•Changes in services or data access
•Certification status changes
•Contract renewal dates
The Auditor Perspective
Auditors check whether your supplier management is proportionate to risk. They'd rather see a pragmatic, risk-based approach for 10 critical suppliers than a superficial review of 200.