Continuous Control Monitoring
Security Questionnaires: Respond with Accurate, Verifiable Answers
Security questionnaires help buyers understand how a supplier protects the data, systems and services involved in a proposed...
Vendor Risk Management Maturity Model for Stronger Oversight
Teams may complete reviews yet struggle to explain which relationships matter, who accepts unresolved risk, or what happens when a supplier changes. Activity is not maturity; decision quality is.
Today’s supply chains call for context. NIST’s July 2026 due-diligence guide for ICT suppliers considers provenance, resilience, foundational cyber practices, foreign ownership, control or influence (FOCI), and supply-chain tiers. In September 2026, US banking agencies proposed third-party risk guidance that would tailor practices to assess risk and organizational context.
Why vendor risk maturity needs a different measure
A maturity model should show whether an organization can make a defensible decision about a dependency, keep it current and learn from outcomes. Review counts and a single score cannot. A portfolio may have good intake but weak change detection or exit readiness.
Treat maturity as a capability profile, not an organization-wide badge. Identify what the team can demonstrate, where confidence stops and what improvement would change a decision. This differs from a vendor-by-vendor review guide. For relationship-level practices, see SPOG’s vendor risk management guide on business impact, access and resilience.
A four-state model for program maturity
This editorial model describes four ways a program makes decisions. It is not a compliance standard or a validated benchmarking instrument. Assess capabilities separately; they need not advance together. Prioritize weaknesses according to the business consequences they could create.
Reactive: decisions depend on individual effort
No dependable view captures material relationships. Reviews start after requests, and rationale may disappear when staff change roles. Begin with a basic record of owner, use, data, access, dependency and decision status.
Repeatable: the program follows a common path
Shared intake steps, review criteria and approval routes make the process repeatable. Teams can see incomplete reviews, but a standard questionnaire can still create false assurance. Check whether staff follow the process and route exceptions to an authorized decision-maker; completion rates do not prove evidence quality.
Contextual: review depth follows the dependency
Reviewers link each use to business processes, data, access, recovery needs and substitutability. They validate relevant evidence and route gaps to accountable owners. Tiers change review depth, safeguards and approval; teams can explain why one supplier receives different scrutiny across engagements.
Adaptive: changes and outcomes reshape oversight
Changes in access, data use, ownership, hosting, incidents or dependencies trigger targeted review. Teams identify repeated findings and concentrations, then adjust criteria. Adaptive practice validates what changed and assigns action; it does not automate every judgment.
Assess six capabilities with observable evidence
Rate each capability from 1 to 4 using the observable anchors below. Assess a defined program scope and period, then sample relationships across criticality tiers, including exceptions and recent changes. Use relationship records to test how the program operates; do not confuse a supplier risk rating with a program capability score.
Retain the sampled records, assessment date, assessor and limitations for each score. Apply higher-state criteria cumulatively within the assessed scope. Where practice varies, record the range and affected population. Use Unknown when evidence is insufficient; do not assume either success or failure. Keep capabilities separate rather than averaging them.
| Capability | 1 Reactive | 2 Repeatable | 3 Contextual | 4 Adaptive |
|---|---|---|---|---|
| Inventory and ownership | Records depend on individuals | Common register and named owners | Uses linked to services and systems | Reconciliation detects missing or changed relationships |
| Tiering and authority | Ad hoc scrutiny and approval | Documented tiers and approval routes | Impact and access determine review and acceptance authority | Incidents and changes test and refine criteria |
| Evidence confidence | Claims accepted without checking | Standard evidence checks recorded | Scope, currency and limitations validated for each use | Evidence changes and review outcomes refine assurance |
| Change detection | Reviews follow surprises | Periodic reviews assigned | Material triggers and response owners defined | Triggers tested and resulting decisions tracked |
| Response and recovery | Reliance on supplier assurances | Plans and contacts documented | Recovery and exit arrangements tested for critical uses | Exercises and incidents drive verified improvements |
| Learning and portfolio insight | Findings remain isolated | Issues and actions tracked | Common dependencies and recurring gaps analyzed | Portfolio findings change criteria and investment |
For critical services, test whether recovery and exit arrangements are usable. Evidence may include a restored data export, verified access revocation, an exercised manual workaround or a transition rehearsal against an agreed business tolerance. A supplier recovery promise alone does not establish your ability to continue operating.
Portfolio analysis should identify shared cloud, identity or other fourth-party dependencies across suppliers. Several individually acceptable relationships may fail together. Record the affected services, plausible disruption and decision owner; assess whether alternatives share the same underlying dependency.
A worked example of uneven maturity
Illustrative example: a payroll SaaS provider processes employee bank details and connects to the identity platform. Sampled records show approved onboarding, a named owner and scheduled reassessment. However, a hosting-region change was discovered during renewal; no notification route or reassessment trigger had been assigned. This supports Repeatable practice for change detection, while evidence confidence could score differently if assurance scope was validated. It does not establish the maturity of the entire portfolio.
The improvement owner agrees a notification route with Procurement, defines relevant hosting and subprocessor changes, and tests the workflow using a simulated notice. By day 90, the test must produce a recorded impact review, an authorized decision and a tracked action where needed. Updating the procedure alone earns no increase. Extend testing to other critical relationships before drawing a broader program conclusion.
Turn the assessment into a 90-day improvement plan
Choose one material gap, define proof of improvement and assign an owner. Avoid redesigning every process at once.
Days 1–30: baseline. Rate representative relationships, attach evidence and separate missing records from missing practice.
Days 31–60: address the constraint. Clarify owners, define evidence checks or pilot a few change triggers, depending on the gap.
Days 61–90: test. Reassess the sample and check whether teams can explain decisions, route gaps and reopen reviews when triggers occur.
Better visibility may initially reveal more issues. Finding them does not itself justify a higher maturity rating. Raise the rating only when evidence demonstrates a more reliable capability, such as validated change detection followed by timely review and accountable action.
Report whether material relationships have accountable owners, whether sampled assurance covers the actual use, and whether triggered reviews reached an authorized decision within the agreed target. State numerator, denominator, assessment period and exclusions. Track overdue actions and expired acceptances separately so improved visibility does not conceal unresolved exposure.
Avoid the maturity traps
Do not equate software with maturity. Tools organize records; they cannot create sound criteria or accountability.
Do not mistake policy for practice. The Institute of Internal Auditors’ Third-Party Topical Requirement, effective September 15, 2026 for relevant internal audit work, addresses assurance over third-party governance, risk management and controls. It is not a universal maturity score.
Do not chase the highest stage everywhere. The OCC’s September 2026 guidance remains a proposal for banking organizations. It emphasizes tailoring practice to assessed risk; proportionality is a design principle, not a new universal mandate.
Do not let averages conceal weak links. Report capability gaps by material relationship tier; a strong average can hide a critical weakness.
Connect maturity assessments to operational evidence
A useful maturity record connects the capability being assessed to its supporting evidence, accountable owner, limitations and improvement action. SPOG.AI’s Governance, Risk and Compliance solution connects requirements, controls and operational evidence. Its Security Maturity solution relates assessments to evidence, business context and ownership, while Continuous Control Monitoring supports ongoing assessment of defined controls. See the linked solution pages in the editorial notes.
These capabilities can help teams maintain traceability and accountability. Supplier selection, contract terms, independent assurance and residual-risk acceptance still require appropriate review and authorized decisions.
Improve the capability that changes decisions
Vendor risk management maturity is not a contest to collect evidence or reach a perfect score. It is the ability to identify dependencies, decide with relevant evidence, revisit decisions when conditions change and learn from outcomes. Start with a profile, not a label. Improve a weak capability, then test whether it changes a decision or response. Leaders can see what the program knows and where confidence ends.
Frequently asked questions
