--- title: Vendor Risk Management – Where to Start - MHA Consulting description: Vendor management gets a lot of attention these days, but have you considered the risk associated with your vendors? We'll show you where to start. image: https://mha-it.com/hubfs/7.webp --- [Skip to content](https://mha-it.com/blog/vendor-risk-management#main-content) [![MHA by BCMMetrics - navy](https://46330580.fs1.hubspotusercontent-na1.net/hub/46330580/hubfs/MHA%20by%20BCMMetrics%20-%20navy.png?width=245&height=54&name=MHA%20by%20BCMMetrics%20-%20navy.png "MHA by BCMMetrics - navy")](https://mha-it.com/) - [Our Consulting Services](https://mha-it.com/what-we-do) - [Business Continuity](https://mha-it.com/business-continuity) - [Crisis Management](https://mha-it.com/crisis-management) - [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services) - [BCaaS](https://mha-it.com/bcaas) - [Program Augmentation](https://mha-it.com/program-augmentation) - [Training and Awareness](https://mha-it.com/training-awareness) - [Our BC Software](https://bcmmetrics.com/) - Resources - [Blog](https://mha-it.com/blog) - [News](https://mha-it.com/news) - [About Us](https://mha-it.com/who-we-are) - [Our Team](https://mha-it.com/our-team) - [Clients](https://mha-it.com/clients) - [In the Community](https://mha-it.com/in-the-community) [Contact Us](https://mha-it.com/contact) [![mhalogo](https://mha-it.com/hubfs/mhalogo.svg "mhalogo")](https://mha-it.com/) [Contact Us](https://mha-it.com/contact) [![mhalogo](https://mha-it.com/hubfs/mhalogo.svg "mhalogo")](https://mha-it.com/) - [Our Consulting Services](https://mha-it.com/what-we-do) - [Business Continuity](https://mha-it.com/business-continuity) - [Crisis Management](https://mha-it.com/crisis-management) - [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services) - [BCaaS](https://mha-it.com/bcaas) - [Program Augmentation](https://mha-it.com/program-augmentation) - [Training and Awareness](https://mha-it.com/training-awareness) - [Our BC Software](https://bcmmetrics.com/) - Resources - [Blog](https://mha-it.com/blog) - [News](https://mha-it.com/news) - [About Us](https://mha-it.com/who-we-are) - [Our Team](https://mha-it.com/our-team) - [Clients](https://mha-it.com/clients) - [In the Community](https://mha-it.com/in-the-community) [Contact Us](https://mha-it.com/contact) [![mhalogo](https://mha-it.com/hubfs/mhalogo.svg "mhalogo")](https://mha-it.com/) [Contact Us](https://mha-it.com/contact) - [Our Consulting Services](https://mha-it.com/what-we-do) - [Business Continuity](https://mha-it.com/business-continuity) - [Crisis Management](https://mha-it.com/crisis-management) - [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services) - [BCaaS](https://mha-it.com/bcaas) - [Program Augmentation](https://mha-it.com/program-augmentation) - [Training and Awareness](https://mha-it.com/training-awareness) - [Our BC Software](https://bcmmetrics.com/) - Resources - [Blog](https://mha-it.com/blog) - [News](https://mha-it.com/news) - [About Us](https://mha-it.com/who-we-are) - [Our Team](https://mha-it.com/our-team) - [Clients](https://mha-it.com/clients) - [In the Community](https://mha-it.com/in-the-community) [Contact Us](https://mha-it.com/contact) Business Impact Analysis # Vendor Risk Management – Where to Start Richard Long Updated on: February 25, 2025 #### Relevant Contents #### Need Tailored Business Continuity Insights? Contact Us Now for Personalized Guidance! [Schedule a Free Consultation](https://mha-it.com/contact) **Vendor management gets a lot of attention these days, but have you considered the risk associated with your vendors? When was the last time you conducted a vendor-related risk assessment? Is vendor risk management (VRM) even a part of your Business Continuity Program?** All organizations are interconnected. This is especially clear for large organizations with considerable numbers of vendors, particularly those with multiple locations or global operations, but even a small businesses with only local suppliers should consider the vendor-related risks to their organizations. ## Definition of a critical vendor: - Any vendor/supplier whose missed commitments might cause the organization to be unable to achieve a stakeholder’s mission. - Any vendor/supplier crucial to recovering from a crisis event. - Key vendors may not be critical for day-to-day operations, but their criticality may increase during crisis events. ## Let’s look at the why of Vendor Risk Management: 1. You have vendors that your organization relies on to function. A vendor may be a supplier of critical goods or services, such as a grocery chain product vendor, or the SaaS provider that runs critical applications. 2. Your vendors are dependent on other critical vendors to provide services or goods. 3. The goods or services provided by critical vendors may not be readily available or easily obtainable by another vendor in your required time period. 4. You may be subject to regulatory requirements, such as [FFIEC Appendix J](https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/). 5. Your customers may require it. ## Here is a checklist of items to consider related to Vendor Risk Management: 1. Understand the [criticality and impacts of your business functions](https://www.mha-it.com/2017/03/bia-and-risk-assesment/). Your vendor impact cannot be completely understood unless you know the criticality of the business processes that are dependent on those vendors. 2. Inventory and prioritize your vendors. You may be surprised how many vendors you have. Understand what goods or services they provide, and how the loss of those can impact your operations. 3. Know who your critical vendors are. For example, you may have a critical SaaS provider that is running on IaaS servers and storage. Are they using a best of breed company or a start-up? 4. Understand each critical vendor’s business continuity strategy. Have you tested it? What components have you tested and verified? 5. Understand how vendors will be able or willing to increase support to you during a crisis event. 6. Review and understand the terms of the contract. What is the actual remediation for missed SLAs or commitments? Often it is only a refund, with no consideration of other costs – which could be substantial. ## Some challenges that may arise: 1. Vendors may not be willing to share information related to their business continuity strategy. 2. Actual vendor criticality is often difficult to determine. 3. Vendor percecption of your organization’s importance. Your vendor may be critical to you, but you may not critical to them. 4. Lack of perceived need within your organization; relying on contract terms without verification. Your BC and DR plans may be functional and effective, but if you vendors cannot support your organization as expected, all those preparations may not be enough. Even basic assessment and remediation efforts related to critical vendor risk can go a long way to providing functional recovery of critical goods and services similar to your own BC/DR efforts. --- ![](https://mha-it.com/hubfs/Richard%20Long-MHA-Consulting.png) #### Richard Long Richard Long is one of MHA’s practice team leaders for Technology and Disaster Recovery related engagements. He has been responsible for the successful execution of MHA business continuity and disaster recovery engagements in industries such as Energy & Utilities, Government Services, Healthcare, Insurance, Risk Management, Travel & Entertainment, Consumer Products, and Education. Prior to joining MHA, Richard held Senior IT Director positions at PetSmart (NASDAQ: PETM) and Avnet, Inc. (NYSE: AVT) and has been a senior leader across all disciplines of IT. He has successfully led international and domestic disaster recovery, technology assessment, crisis management and risk mitigation engagements. ## Start building a stronger future ##### Navigate uncertainty with an expert - schedule your free consultation with our CEO, Michael Herrera. [Schedule your consultation](https://mha-it.com/contact) ## Other resources you might enjoy ![](https://46330580.fs1.hubspotusercontent-na1.net/hub/46330580/hubfs/vendorrisk.png?height=245&name=vendorrisk.png) #### [6 Tips to Help You Vet Your Third-Party Vendors](https://mha-it.com/blog/vendor-risk-vetting-business-continuity) [Read More](https://mha-it.com/blog/vendor-risk-vetting-business-continuity) ![Critical supplier vetting meeting reviewing supplier dependencies, continuity evidence, recovery capabilities, risk levels, and alternate sources.](https://46330580.fs1.hubspotusercontent-na1.net/hub/46330580/hubfs/Managing%20Third-Party%20Risk.png?height=245&name=Managing%20Third-Party%20Risk.png) #### [Third-Party Risk Management: How to Vet Critical Suppliers](https://mha-it.com/blog/third-party-risk-critical-suppliers) [Read More](https://mha-it.com/blog/third-party-risk-critical-suppliers) ![](https://46330580.fs1.hubspotusercontent-na1.net/hub/46330580/hubfs/Blog%20images/Imported_Blog_Media/Getting-the-Most-out-of-Your-Vendor-Search2.jpg?height=245&name=Getting-the-Most-out-of-Your-Vendor-Search2.jpg) #### [Trust, But Verify: 7 Best Practices for Managing Vendor Risk](https://mha-it.com/blog/best-practices-third-party-risk-management) [Read More](https://mha-it.com/blog/best-practices-third-party-risk-management) ## Ready to start focusing on higher-level challenges? [![MHA by BCMMetrics - White](https://46330580.fs1.hubspotusercontent-na1.net/hub/46330580/hubfs/MHA%20by%20BCMMetrics%20-%20White.png?width=308&height=68&name=MHA%20by%20BCMMetrics%20-%20White.png "MHA by BCMMetrics - White")](https://mha-it.com/) Business continuity consulting for today’s leading companies. #### Company - [Who We Are](https://mha-it.com/who-we-are) - [Team](https://mha-it.com/our-team) - [Clients](https://mha-it.com/clients) - [News](https://mha-it.com/news) - [Blog](https://mha-it.com/blog) - [Contact](https://mha-it.com/contact) #### Services - [Business Continuity](https://mha-it.com/business-continuity) - [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services) - [Crisis Management](https://mha-it.com/crisis-management) - [BCaaS](https://mha-it.com/bcaas) - [Training & Awareness](https://mha-it.com/training-awareness) - [Program Augmentation](https://mha-it.com/program-augmentation) © 2026 MHA Consulting. All rights reserved.  [Privacy Policy](https://mha-it.com/privacy-policy) ```json { "@context" : "", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://mha-it.com", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://mha-it.com/blog", "name" : "Blog", "position" : 2 }, { "@type" : "ListItem", "name" : "Vendor Risk Management – Where to Start", "position" : 3 } ] } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Richard Long", "url" : "https://mha-it.com/blog/author/richard-long" }, "dateModified" : "2025-02-25T11:01:16.145Z", "datePublished" : "2024-09-18T20:29:57.000Z", "headline" : "Vendor Risk Management – Where to Start - MHA Consulting", "image" : [ "https://mha-it.com/hubfs/7.webp" ], "mainEntityOfPage" : { "@id" : "https://mha-it.com/blog/vendor-risk-management", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://mha-it.com/hubfs/Frame%2016353%20(1).svg" } } } ```