--- title: "Trust, But Verify: 7 Best Practices for Managing Vendor Risk" description: Learn the key aspects and best practices of third-party risk management to protect your business from costly vendor-related risks. image: https://46330580.fs1.hubspotusercontent-na1.net/hubfs/46330580/Blog%20images/Imported_Blog_Media/Getting-the-Most-out-of-Your-Vendor-Search2.jpg --- [Skip to content](https://mha-it.com/blog/best-practices-third-party-risk-management#main-content) [![MHA by BCMMetrics - navy](https://46330580.fs1.hubspotusercontent-na1.net/hub/46330580/hubfs/MHA%20by%20BCMMetrics%20-%20navy.png?width=245&height=54&name=MHA%20by%20BCMMetrics%20-%20navy.png "MHA by BCMMetrics - navy")](https://mha-it.com/) - [Our Consulting Services](https://mha-it.com/what-we-do) - [Business Continuity](https://mha-it.com/business-continuity) - [Crisis Management](https://mha-it.com/crisis-management) - [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services) - [BCaaS](https://mha-it.com/bcaas) - [Program Augmentation](https://mha-it.com/program-augmentation) - [Training and Awareness](https://mha-it.com/training-awareness) - [Our BC Software](https://bcmmetrics.com/) - Resources - [Blog](https://mha-it.com/blog) - [News](https://mha-it.com/news) - [About Us](https://mha-it.com/who-we-are) - [Our Team](https://mha-it.com/our-team) - [Clients](https://mha-it.com/clients) - [In the Community](https://mha-it.com/in-the-community) [Contact Us](https://mha-it.com/contact) [![mhalogo](https://mha-it.com/hubfs/mhalogo.svg "mhalogo")](https://mha-it.com/) [Contact Us](https://mha-it.com/contact) [![mhalogo](https://mha-it.com/hubfs/mhalogo.svg "mhalogo")](https://mha-it.com/) - [Our Consulting Services](https://mha-it.com/what-we-do) - [Business Continuity](https://mha-it.com/business-continuity) - [Crisis Management](https://mha-it.com/crisis-management) - [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services) - [BCaaS](https://mha-it.com/bcaas) - [Program Augmentation](https://mha-it.com/program-augmentation) - [Training and Awareness](https://mha-it.com/training-awareness) - [Our BC Software](https://bcmmetrics.com/) - Resources - [Blog](https://mha-it.com/blog) - [News](https://mha-it.com/news) - [About Us](https://mha-it.com/who-we-are) - [Our Team](https://mha-it.com/our-team) - [Clients](https://mha-it.com/clients) - [In the Community](https://mha-it.com/in-the-community) [Contact Us](https://mha-it.com/contact) [![mhalogo](https://mha-it.com/hubfs/mhalogo.svg "mhalogo")](https://mha-it.com/) [Contact Us](https://mha-it.com/contact) - [Our Consulting Services](https://mha-it.com/what-we-do) - [Business Continuity](https://mha-it.com/business-continuity) - [Crisis Management](https://mha-it.com/crisis-management) - [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services) - [BCaaS](https://mha-it.com/bcaas) - [Program Augmentation](https://mha-it.com/program-augmentation) - [Training and Awareness](https://mha-it.com/training-awareness) - [Our BC Software](https://bcmmetrics.com/) - Resources - [Blog](https://mha-it.com/blog) - [News](https://mha-it.com/news) - [About Us](https://mha-it.com/who-we-are) - [Our Team](https://mha-it.com/our-team) - [Clients](https://mha-it.com/clients) - [In the Community](https://mha-it.com/in-the-community) [Contact Us](https://mha-it.com/contact) Risk Management # Trust, But Verify: 7 Best Practices for Managing Vendor Risk Richard Long Updated on: May 19, 2025 #### Relevant Contents #### Need Tailored Business Continuity Insights? Contact Us Now for Personalized Guidance! [Schedule a Free Consultation](https://mha-it.com/contact) Many companies fail to follow through in planning for supply-chain disruptions, but the loss of a critical vendor can bring operations at an unprepared company to a standstill. Today’s blog offers seven best practices every organization should follow to reduce its vulnerability to vendor outages.   ## Managing Third-Party Risk in 2025 There’s never a bad time to talk about the importance of supply-chain resilience. The loss of a critical supplier has always had the ability to cause pain to an unprepared company. And the area has long been one where even responsible companies tend to fall short.  That said, right now might be an especially *good* time to talk about supply-chain security, given the ongoing tensions on the international scene and the new uncertainty regarding tariffs. Thankfully, in 2025 awareness of the issue of vendor vulnerability is more widespread than it used to be. For that, we can thank COVID and our recent experience of empty store shelves and stacked-up container ships. Unfortunately, awareness has been slow to translate to action, if MHA consultants’ experience in the field is any guide.  We’ve seen a lot of companies identify where the risks in their vendors lie. But relatively few organizations have taken the next step of remediating their vulnerabilities.   ## Awareness Isn’t Enough: The Importance of Taking Action Third-party risk management isn’t complicated. It comes down to assessing which vendors you rely on most as well which of your suppliers are the most vulnerable to disruptions. Once you’ve done that, you need to make arrangements in advance to cope with their potential loss, whether by finding redundant vendors, stockpiling product, and/or planning to perform the service in-house.  It's straightforward but it requires being proactive rather than reactive, which many organizations find hard to do. It’s about being aware and making conscious decisions, rather than putting one’s head in the sand or leaving things to chance.   ## 7 Best Practices for Managing Third-Party Risk Here are seven best practices every organization should follow to secure their vendors and improve their operational resilience. - ### Identify Your Critical Vendors Start by determining which vendors your business truly depends on to maintain critical operations. Don’t confuse this with how much you spend—some of your most essential suppliers may not be your most expensive. Classify vendors based on their importance to your organization: high, medium, or low. This sets the foundation for your entire third-party risk strategy.   - ### Assess the Resilience of Key Vendors Once you know who matters most, evaluate how vulnerable they are to disruption. Ask questions about their risk exposure and business continuity planning. Place them into categories—high, medium, or low—based on how likely they are to experience a disruption. If they resist sharing information, treat that as a risk indicator and plan accordingly.   - ### Make Backup Plans and Arrangements Ahead of Time Starting with your most critical and most vulnerable vendors, develop contingency plans before a disruption occurs. Options include lining up alternate suppliers, stockpiling essential goods, or preparing to bring the function in-house. Be aware that with regulated products, switching vendors may involve delays due to compliance and approval processes.   - ### Build Resilience Requirements into Your Vendor Contracts Work to embed resilience requirements directly into your contracts. This may involve gaining access to your vendor’s BC plans, setting expectations for recovery time, or outlining responsibilities during a disruption. Success here often depends on your leverage and persistence—negotiating contract language may take time and repeated dialogue.   - ### Don’t Be Fooled by Size A common misconception is that large or well-known vendors are immune to outages. In reality, size does not guarantee resilience. Always perform due diligence—even industry giants can experience failures that impact your business.   - ### Consider the Resilience of Your Vendors’ Vendors Your vendors rely on suppliers of their own, and weaknesses in those secondary vendors can impact you. Ask about your vendors’ critical dependencies and how they manage them. True resilience requires looking one or two layers deeper.   - ### Review and Refresh Regularly Third-party risk management isn’t a set-it-and-forget-it exercise. Review your vendor landscape, risk assessments, and continuity plans at least annually—or sooner if there are changes to your operations, your vendors, or the regulatory environment. By following these best practices, organizations can significantly reduce their exposure to third-party disruptions and build a vendor that’s ready for whatever comes next.   ## Vendor Resilience Starts Now Managing third-party risk may seem complex, but the core principles are straightforward: know which vendors matter most, understand how resilient they are, and prepare for the unexpected. By systematically identifying vulnerabilities and addressing them through proactive planning, organizations can avoid the costly consequences of supply-chain disruption. The good news is that resilience is within reach. By putting these best practices into action, businesses can strengthen their vendor relationships, improve operational stability, and position themselves to weather future shocks with confidence.   --- ## Further Reading - [Vulnerable Vendors: Supplier Weaknesses Put Your Organization at Risk](https://mha-it.com/blog/vulnerable-vendors) - [How to Stop Third-Party Vendors from Becoming Your Achilles’ Heel](https://mha-it.com/blog/third-party-vendors-achilles-heel) - [The Corporate Supply Chain: BCM’s Ticking Time Bomb](https://bcmmetrics.com/blog/corporate-supply-chain) - [Strengthening the Chain: Four Steps to a More Secure Corporate Supply Chain](https://bcmmetrics.com/blog/supply-chain-risk-management) - [You Have to Kick the Tires: Protecting Yourself Against Supply-Chain Catastrophes](https://bcmmetrics.com/blog/supply-chain-risk) --- ![](https://mha-it.com/hubfs/Richard%20Long-MHA-Consulting.png) #### Richard Long Richard Long is one of MHA’s practice team leaders for Technology and Disaster Recovery related engagements. He has been responsible for the successful execution of MHA business continuity and disaster recovery engagements in industries such as Energy & Utilities, Government Services, Healthcare, Insurance, Risk Management, Travel & Entertainment, Consumer Products, and Education. Prior to joining MHA, Richard held Senior IT Director positions at PetSmart (NASDAQ: PETM) and Avnet, Inc. (NYSE: AVT) and has been a senior leader across all disciplines of IT. He has successfully led international and domestic disaster recovery, technology assessment, crisis management and risk mitigation engagements. ## Start building a stronger future ##### Navigate uncertainty with an expert - schedule your free consultation with our CEO, Michael Herrera. [Schedule your consultation](https://mha-it.com/contact) ## Other resources you might enjoy ![](https://46330580.fs1.hubspotusercontent-na1.net/hub/46330580/hubfs/vendorrisk.png?height=245&name=vendorrisk.png) #### [6 Tips to Help You Vet Your Third-Party Vendors](https://mha-it.com/blog/vendor-risk-vetting-business-continuity) [Read More](https://mha-it.com/blog/vendor-risk-vetting-business-continuity) ![Vulnerable Vendors: Supplier Weaknesses Put Your Organization at Risk](https://46330580.fs1.hubspotusercontent-na1.net/hub/46330580/hubfs/Imported_Blog_Media/vulnerable-vendors.jpg?height=245&name=vulnerable-vendors.jpg) #### [Vulnerable Vendors: Supplier Weaknesses Put Your Organization at Risk](https://mha-it.com/blog/vulnerable-vendors) [Read More](https://mha-it.com/blog/vulnerable-vendors) ![Vendor Risk Management – Where to Start](https://mha-it.com/hs-fs/hubfs/7.webp?height=245&name=7.webp) #### [Vendor Risk Management – Where to Start - MHA Consulting](https://mha-it.com/blog/vendor-risk-management) [Read More](https://mha-it.com/blog/vendor-risk-management) ## Ready to start focusing on higher-level challenges? [![MHA by BCMMetrics - White](https://46330580.fs1.hubspotusercontent-na1.net/hub/46330580/hubfs/MHA%20by%20BCMMetrics%20-%20White.png?width=308&height=68&name=MHA%20by%20BCMMetrics%20-%20White.png "MHA by BCMMetrics - White")](https://mha-it.com/) Business continuity consulting for today’s leading companies. #### Company - [Who We Are](https://mha-it.com/who-we-are) - [Team](https://mha-it.com/our-team) - [Clients](https://mha-it.com/clients) - [News](https://mha-it.com/news) - [Blog](https://mha-it.com/blog) - [Contact](https://mha-it.com/contact) #### Services - [Business Continuity](https://mha-it.com/business-continuity) - [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services) - [Crisis Management](https://mha-it.com/crisis-management) - [BCaaS](https://mha-it.com/bcaas) - [Training & Awareness](https://mha-it.com/training-awareness) - [Program Augmentation](https://mha-it.com/program-augmentation) © 2026 MHA Consulting. All rights reserved.  [Privacy Policy](https://mha-it.com/privacy-policy) ```json { "@context" : "", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://mha-it.com", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://mha-it.com/blog", "name" : "Blog", "position" : 2 }, { "@type" : "ListItem", "name" : "Trust, But Verify: 7 Best Practices for Managing Vendor Risk", "position" : 3 } ] } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Richard Long", "url" : "https://mha-it.com/blog/author/richard-long" }, "dateModified" : "2025-05-19T20:17:32.678Z", "datePublished" : "2025-05-19T17:48:32.000Z", "headline" : "Trust, But Verify: 7 Best Practices for Managing Vendor Risk", "image" : [ "https://46330580.fs1.hubspotusercontent-na1.net/hubfs/46330580/Blog%20images/Imported_Blog_Media/Getting-the-Most-out-of-Your-Vendor-Search2.jpg" ], "mainEntityOfPage" : { "@id" : "https://mha-it.com/blog/best-practices-third-party-risk-management", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://mha-it.com/hubfs/Frame%2016353%20(1).svg" } } } ```