Every vendor-risk programme runs out of reviewers before it runs out of vendors. A design agency on a small retainer and the provider that hosts your production systems cannot get the same review, and the team that tries to give them the same review ends up giving neither the right one. Tiering decides how hard to look. A risk score decides what you found when you looked. Both only work if someone outside the risk team can read them and agree, or argue with a specific line.
This post explains how InsightVendors sets a tier and scores risk in two stages — inherent risk from what the vendor touches, residual risk from what the vendor proves — using the demo organisation, Northwind Labs, and its fictional vendors. It also shows where the demo score breaks down, and what that teaches about reading any risk score.
In short
- Tier first, then score. The tier (Critical, High, Moderate, Low) sets the depth of review, the questionnaire and the reassessment cadence. It comes from rules you own: data sensitivity, system access, business criticality, spend and regulatory flags.
- Two numbers, not one. Inherent risk (before controls) says how much could go wrong. Residual risk (after evidence) says how much is left once documents, answers, findings and signals are counted.
- Every point has a reason. Stackforge, the demo’s production host, scores inherent 89 from five listed factors; its SOC 2 Type II, ISO 27001 certificate, pen test and insurance take off 26.7, 13.3, 7.1 and 4.5 points.
- The arithmetic is deterministic. Weights are yours; the Risk agent explains the number but never invents it.
- A score that hits 100 is a prompt to triage findings, not a number to put in front of the board.
Why one review for every vendor fails
Third-party risk management (TPRM) teams are usually small, and the queue is usually long. If every new supplier gets the full security questionnaire, a contract review and a privacy assessment, two things happen. Low-risk purchases wait weeks for reviews that will find nothing, and the business learns to route around procurement. Meanwhile the vendors that matter get the same attention as the ones that do not, because the reviewers are spread thin.
Regulators and auditors expect the opposite. The US interagency guidance on third-party relationships (OCC, Federal Reserve and FDIC, June 2023) asks for risk management that is commensurate with the level of risk and the complexity of the relationship. DORA, which applies in the EU from 17 January 2025, distinguishes ICT services that support critical or important functions. ISO/IEC 27001:2022 Annex A 5.19–5.23 asks you to manage information security across supplier relationships according to their risk. None of them asks you to treat a stationery supplier like a cloud host. Confirm the exact obligations with your compliance team; the direction is consistent.
data
Breach studies have repeatedly found that incidents involving a third party or the supply chain are common and tend to cost more than average. That is an argument for looking harder at the vendors that can cause such incidents, not for looking equally hard at all of them.
Sources: Verizon Data Breach Investigations Report 2024 and 2025 (sharp rise in breaches involving a third party); IBM Cost of a Data Breach Report 2024 (global average about US$4.9M; supply-chain involvement associated with higher cost). Figures vary by year and method.
Tiers: how hard to look
InsightVendors has four tiers. The rules that assign them are the customer’s, not ours: you decide which data types, which kinds of system access, what criticality and what spend push a vendor up a tier, and which regulatory flags (a processor of personal data, an outsourced critical function) set a floor. The tier then drives everything downstream.
| Tier | Typical profile | What it changes | Reassessment (demo) |
|---|---|---|---|
| Tier 1 · Critical | Production systems, credentials, customer data at scale, hard to replace | Full security, privacy and contract review; strictest insurance minimums; monitoring reactions escalate | Every 12 months |
| Tier 2 · High | Personal or customer data, integrations, meaningful spend | Core security questionnaire plus privacy; contract checked against the playbook | Every 12 months |
| Tier 3 · Moderate | Limited data, limited access, replaceable | Lighter questionnaire, document check | Every 24 months |
| Tier 4 · Low | No sensitive data, no system access, small spend | Fast-track template, minimal review | Every 36 months |
The demo spreads its eight fictional vendors across all four. Stackforge (cloud infrastructure, production hosting, $420k a year) and Vaultline (secrets management) are Tier 1. Callwave (sales call recording), Ledgerly (accounts payable), NimbusDesk (support desk) and Quill AI (generative AI for support replies) are Tier 2. PeopleLoop, the HR system, is Tier 3. BrightPixel, a $12k design retainer, is Tier 4. The Insights page shows the result as spend by tier: $448,000 of Northwind’s $690,000 under management sits in Tier 1, which is a useful sentence on its own.
A tier is set by the Risk agent when a request is triaged and can be overridden by a person with a reason. The override is recorded. That matters later, when an auditor asks why a vendor holding customer data was reviewed as Tier 3.
Inherent risk: what the vendor touches
Inherent risk is the risk of the relationship before you have looked at a single control. It comes from facts the business already knows when it asks for the tool: what data the vendor will handle, which of your systems it will reach, how badly an outage would hurt, how much you spend and whether it processes personal data on your behalf. Each fact adds points to a domain — security, privacy, operational, financial, compliance, reputational, concentration or AI — and the points are listed.
Stackforge’s inherent score is 89. The Vendor 360 page shows exactly why:
| Domain | Factor | Points |
|---|---|---|
| Security | Handles credentials and 2 more data types | +38 |
| Security | Access to our systems: production | +20 |
| Operational | Business criticality: critical | +20 |
| Financial | Annual spend $420,000 | +6 |
| Compliance | Subprocessor of our customers’ personal data | +5 |
| Inherent | 89 |
Callwave, the Tier 2 call-recording vendor, comes to 65: handles PII and one more data type +26, access to our systems through an integration +12, business criticality high +14, annual spend $64,000 +3, subprocessor of customers’ personal data +5, and processes data outside the home region +5. Anyone in the business can read those lines and challenge one. If sales says Callwave is not really high criticality, that is a conversation about one factor worth 14 points, not a debate about a black box.
Residual risk: what the vendor proves
Residual risk starts from inherent and moves with evidence. Documents the Document agent has read, answers the vendor has given in the portal, findings that are open and signals from monitoring all contribute. Good evidence takes points off. Open problems add them back. The result is again 0–100, overall and per domain, with each line visible.
Stackforge’s assurance reductions in the demo are:
| Evidence | Reduction |
|---|---|
| Current SOC report (Type II) | −26.7 |
| ISO 27001 certificate in date | −13.3 |
| Penetration test in the last 12 months with no open criticals | −7.1 |
| Insurance meets the tier’s minimums | −4.5 |
Note that the same evidence is worth different amounts for different vendors. Callwave’s current SOC 2 Type II takes off 19.5; Stackforge’s takes off 26.7. The reduction scales with the risk in the domain it covers: a SOC report means more for a vendor with more security exposure. The weights behind that are published to the customer and owned by the customer.
data, systems, criticality, spend"] --> B["Inherent score
per domain, 0-100"] B --> T["Tier
Critical / High / Moderate / Low"] B --> C["Residual score"] D["Assurance
SOC 2, ISO, pen test, insurance"] -- "reduces" --> C E["Open findings and signals"] -- "adds" --> C C --> F["Review depth, cadence,
monitoring reaction, renewal advice"]
Inherent risk sets the tier; evidence moves the residual score; both drive what happens next.
Deterministic arithmetic, explained by an agent
The Risk agent runs whenever something changes what is known about a vendor: a new document, an answer, a finding, a signal. It recomputes the score with the published formula and writes an explanation. What it does not do is pick the number. The score is arithmetic over customer-owned weights; the same facts always produce the same score. If a model is available, it writes a better explanation; if none is, the rule-based path produces the same number and a plainer explanation. A grounding check throws away any model answer that contains a number not in the source facts.
This is a deliberate choice, and it is the main reason the score can be argued with. A score a language model produced from reading the documents would differ between runs, and nobody could say which factor to correct. A score built from listed factors can be corrected one factor at a time.
A number from a questionnaire total or a vendor-rating feed. Hard to explain to the business, hard to challenge, and it moves without anyone being able to say why.
Inherent from what the vendor touches, residual from what it proves. Each point has a line and a domain; the weights are yours; the history is kept for the trend.
Tier × residual risk: where to spend attention
Put the two together and you get the view a vendor-risk lead actually manages from. Tier says how much the vendor matters; residual risk says how well it is controlled. A high-tier vendor with low residual risk is a well-run critical supplier: keep watching. A low-tier vendor with high residual risk may deserve a look, but rarely urgency. The top-right corner is the work.
Positions are illustrative. In the demo, Insights shows two Tier 1 and four Tier 2 vendors in the critical residual column.
When the score saturates
The demo is candid about a weakness, and it is worth dwelling on. Stackforge’s residual score is 100 even though its inherent score is 89 and it has a current SOC 2 Type II, an in-date ISO 27001 certificate, a recent pen test and adequate insurance. The reason is the findings line. The Document agent read Stackforge’s four documents and raised 23 findings, each citing a page. Open findings add points, and 23 of them overwhelm the assurance. Callwave shows the same pattern more starkly: 21 open findings add 126 points to an inherent score of 65.
Six of the eight demo vendors land in the critical column for this reason. That does not mean Northwind has six equally dangerous suppliers. It means the findings have not been triaged. Many automatically raised findings are low severity, duplicates of one another, or things the vendor has already fixed. Some will be accepted as risk with an expiry date. Until a person has worked through them, the score is telling you about the size of the review backlog, not the vendor.
Read a score of 100 as a to-do list
A residual score that saturates at 100 is a signal to triage findings, not a number to report. It cannot tell a vendor with one serious unresolved problem from one with twenty minor ones, and it will not move until findings are closed, merged or accepted. In the demo, most vendors sit at 100 because the Document agent raised many findings on first read. Before you report residual scores upward, triage the findings queue and tune the per-finding weights in settings so that severity matters more than count.
That is the right behaviour from a system that refuses to make up numbers: when evidence says many things are open, the score says so. The fix is in the operating model — triage, accepted risk, weights that reflect severity — not in quietly capping the arithmetic.
Making the score defensible
A score is defensible when four people can each find what they need in it.
For the CISO
Which Tier 1 vendors have high residual risk, and which single factor would bring each one down most.
Whether assurance is current: an expired SOC report should raise a signal and a finding, as Ledgerly’s expired SOC 1 did.
For the vendor-risk lead
Every factor, every weight and every override in one place, with the history kept for the trend.
Reassessment dates set by tier so the cadence is defended by policy, not by memory.
For the board
How much spend and how many critical services sit with vendors in the top-right corner.
That tiering rules exist, are owned and are applied consistently.
Which data types, access levels, criticality and spend move a vendor up a tier; which regulatory flags set a floor.
Reassessment months, insurance minimums (the demo uses cyber $2M, E&O $2M, GL $1M), questionnaire template.
Check how much each kind of evidence and each finding severity moves the score. Make severity count more than volume.
Inherent and residual for every vendor, with explanations. Expect many scores to rise on first document read.
Close, merge or accept with expiry. Re-score. Only then take residual numbers to a committee.
So the next reviewer, and the auditor, can see why.
What it adds up to
Tiering protects your reviewers’ time and the business’s patience: BrightPixel goes through a fast track, Stackforge gets the full review and a twelve-month cadence. Two-stage scoring makes the result explainable: inherent risk is the business’s own description of the relationship turned into points, residual risk is what the evidence did to it. And because the arithmetic is fixed and every line is shown, a disagreement becomes a conversation about one factor rather than a question of trust in a number.
Tier by what the vendor touches. Score by what it proves. Show every point.
A score you cannot argue with line by line is a score nobody should act on. A score that hits 100 is telling you to triage, not to panic.