Sharp. Not sentimental.
847 Vendors. 23 Critical. 4 Unowned. 2 Unassessed. The Board Knew None of It.
A technology firm's vendor risk review — initiated as part of an annual governance cycle — found that of 847 active vendor relationships, 23 were classified as critical to business continuity, 4 critical vendors had no named risk owner following a restructure six months earlier, and 2 critical vendors had not been through a risk assessment in over two years.
None of this was known to the board. The board risk report contained a single line item: 'Third-party risk — managed within appetite.' The assessment was technically accurate for the 843 non-critical vendors. For the 4 unowned critical relationships, it was not.
When the board received the review findings, the chair asked why the four unowned relationships had not surfaced sooner. The honest answer was that the governance model had no mechanism to surface them. The vendor register did not automatically flag ownership gaps. They were only visible when someone looked for them.
Honest. Not accusatory.
Third-Party Risk Governance Is Designed for the Vendor Inventory. Not for the Critical Relationships Within It.
Most vendor risk programmes are built around the inventory: a list of vendors, assessed on a schedule, with risk ratings that aggregate into a single board report line. The programme manages the inventory well. It manages the critical relationships within the inventory poorly.
The distinction matters because critical vendors — the ones whose failure would produce material operational, financial, or reputational consequences — require governance that is qualitatively different from standard vendor management. They need named owners with real authority. They need assessment cadences that reflect their criticality, not the standard cycle. They need direct board visibility, not an aggregated single line.
When the governance model treats all vendors as inventory items and applies the same process to all of them, the critical relationships are managed at the same level as the least consequential ones. The gaps that matter — unowned relationships, overdue assessments, concentration in single suppliers — are invisible until someone specifically looks for them.
Simple. Not simplistic.
The Vendor Risk Tiering Model: Three Tiers, Three Governance Standards.
A tiered governance model applies different governance standards to different vendor criticality levels. The tiers are not defined by spend or relationship length — they are defined by the consequence of failure.
| TIER | DEFINITION | GOVERNANCE STANDARD |
|---|---|---|
| Critical (Tier 1) | Failure would produce material operational, financial, or regulatory consequences within 72 hours. | Named board-visible owner. Quarterly assessment minimum. Board report with named status. Exit plan documented and tested. No unowned relationships permitted. |
| Important (Tier 2) | Failure would produce significant disruption but with managed recovery within weeks. | Named management-level owner. Annual assessment minimum. CRO-level visibility. Escalation pathway documented. |
| Standard (Tier 3) | Failure would produce inconvenience but no material consequence. | Vendor inventory management. Periodic assessment on standard cycle. Aggregated reporting acceptable. |
Tier 1 relationships are not just risk-managed — they are governed. That distinction produces different behaviours: named board-visible owners who cannot be silently removed by a restructure, assessment cadences that are not deferred for operational convenience, and board reports that show the status of each critical relationship by name rather than in aggregate.
Most organisations currently manage their Tier 1 relationships under Tier 3 governance standards, with Tier 3 aggregate reporting. The gap between those two standards is where critical vendor failures originate.
Practical. Not obvious.
Run the Critical Vendor Audit. Four Questions.
Pull your vendor register.
The count is the finding. Four gaps across four critical vendors is not a minor documentation issue. It is a governance exposure that the board cannot see and therefore cannot govern.
The fix is specific: assign owners, schedule assessments, update the board report format, document exit plans. Each of these is a decision, not a programme. They can be made this week.
Open. Not pushy.
The Decision Infrastructure Self-Assessment
The ownership link — including vendor risk ownership — is one of four links mapped in this assessment. Ownership gaps in critical vendor relationships consistently surface as one of the most consequential breaks in the governance chain.
Access here →Book a 45-Minute Decision Architecture Conversation
If the critical vendor audit produced gaps you weren't expecting, the diagnostic session maps the tiering model for your specific vendor portfolio and what Tier 1 governance looks like in practice.
Book a diagnostic session →That's The Decision Layer for this week.
847 vendors managed consistently is an operational achievement. 4 critical vendors unowned is a governance failure. The tiering model separates the two.
Forward this to a CISO, COO, or Head of Third-Party Risk who is running a vendor programme and knows — privately — that the critical relationships aren't getting different governance from the rest.