Third-Party Risk Doesn’t Start With Questionnaires

Requesting third-party risk due diligence through ServiceNow’s Employee Center.

Why mature TPRM begins with due diligence, not forms

Many organizations treat third-party risk management (TPRM) as a questionnaire exercise.

A vendor is identified. A spreadsheet or portal is opened. A long list of security questions is sent out.

And only after responses come back does anyone step back to ask:

Was this even the right level of scrutiny?

This approach is common, and it’s exactly why TPRM programs become slow, noisy, and misaligned with actual risk.

In reality, effective third-party risk management starts well before questionnaires are sent.

The real starting point: request-driven due diligence

Mature TPRM programs begin with a formal request for due diligence, not an assessment template.

That initial request forces clarity around:

• What service is being outsourced

• What data is involved

• Whether the service is business-critical

• Where regulatory exposure exists

Answering these questions upfront enables the organization to determine the appropriate scope and intensity of risk evaluation.

This is the difference between:

• Blanket vendor assessments

• And risk-based, proportionate due diligence

  
  

Why questionnaires alone don’t scale

Questionnaires are not inherently bad. They’re just often misused.

Common failure modes include:

• Sending the same assessment to low-risk and high-risk vendors

• Collecting responses that never impact a risk decision

• Treating completion as success instead of insight

Without upfront due diligence and inherent risk tiering, questionnaires become

• A compliance checkbox

• A vendor frustration point

• A false sense of control

  
  

Triggered external assessments (NIST _BCM _Privacy)

What a risk-based TPRM lifecycle actually looks like

A defensible third-party risk lifecycle typically follows this order:

1. Request due diligence Formal intake that captures service scope, data sensitivity, and criticality

2. Inherent risk assessment Early risk signals determine vendor tier and depth of review

3. Risk-driven assessment selection Questionnaires are triggered based on risk, not habit

4. Targeted external assessments Only relevant frameworks (e.g., security, privacy, resilience) are applied

5. Issue identification and remediation Gaps are tracked, discussed, and resolved, not buried

6. Documented risk decision and closure Acceptance, remediation, or rejection is formally recorded

This structure aligns far better with regulatory expectations than “questionnaire-first” programs.

Issue resolved; third party to remediate

Why regulators care about the process, not just the answers

Across major frameworks, the emphasis is consistent:

• OSFI B-10 expects institutions to demonstrate risk-based third-party oversight, proportional controls, and clear accountability.

• ISO/IEC 27001 requires supplier risk to be identified, assessed, and monitored as part of the ISMS.

• SOC 2 looks for evidence that vendors impacting trust services criteria are appropriately governed.

None of these standards say:

“Send a questionnaire and move on.”

They all require judgment, traceability, and governance.

Tools don’t replace thinking—they should enable it

Modern GRC platforms can absolutely help.

When used correctly, they:

• Enforce intake discipline

• Automate risk-based triggers

• Preserve audit trails

• Support issue management and closure

When used poorly, they simply digitize bad processes.

The difference isn’t the tool—it’s the design of the workflow.

A practical example: end-to-end TPRM in practice

I recently documented a full end-to-end third-party risk due diligence lifecycle using a modern GRC platform, covering:

• Formal due diligence request and onboarding

• Inherent risk tiering tied to service criticality

• Risk-driven questionnaire triggering (security, privacy, resilience)

• External assessment collaboration

• Issue creation, remediation, and documented closure

The focus wasn’t on screenshots—it was on decision points and risk ownership.

👉 You can view the full project here: End-to-End Third-Party Risk Management (ServiceNow TPRM)

Final thought

If your TPRM program starts with a questionnaire, it’s already too late.

Start with:

• Clear intake

• Risk-based scoping

• Proportionate due diligence

Then use questionnaires as tools, not substitutes for governance.

That’s how third-party risk becomes manageable—and defensible.

If you’re building or maturing a third-party risk program and want practical, regulator-aligned approaches, explore the projects and tools on this site.