Auditors ask for a vendor list, a way you rate vendors by risk, proof you reviewed the important ones, and the contract terms that protect your data. Show a yearly review with decisions, such as renewed, replaced or monitored, rather than a folder of downloaded reports nobody read.
Start with the inventory
List every vendor that touches customer data or supports your service. Include the owner, what data they handle, the contract date and a risk tier. If you cannot name your vendors, you cannot show you manage them.
Build the list from several sources: finance records, single sign on apps and your cloud marketplace. Each finds vendors the others miss.
Tier by risk
Two or three tiers are enough. A vendor that stores production customer data is high. A design tool with no customer data is low. Write the criteria and apply them consistently.
Review the high tier
For each high risk vendor, keep the evidence you reviewed: their assurance report or questionnaire, the date, and a short note of what you checked. Look at the report period, the opinion, the exceptions and the user entity controls you are expected to run yourself.
A note saying "reviewed, exceptions not relevant to our use, complementary controls mapped to our MFA policy" beats a bare download.
Contracts and security terms
Keep signed agreements with confidentiality, breach notice and data handling terms for vendors that handle customer data. Keep the date of signature. Auditors sample these.
Yearly review and offboarding
Once a year, revisit the list. Record which vendors were added, dropped or re-rated. When you stop using a vendor, show that access was removed and data was returned or deleted according to the contract.
Common gaps
- Reports older than the vendor's current period.
- No owner for a vendor.
- Reviews done once at signup and never again.
- Shadow tools adopted by teams without a review.
A lightweight review template
For each high tier vendor, record: what data they handle, which assurance report you reviewed and its period, the opinion type, any exceptions that touch your use, complementary controls you must run, and the decision. One paragraph per vendor is enough.
Mind the gaps between reports
If the vendor's report ends months before your audit period, ask for a bridge letter or check for a newer report. If neither exists, record the risk and how you compensate. Being open about that gap is better than leaving it unmentioned.
Assign vendor owners within the business, not only in security. The team that uses the tool knows when it changes how it handles data, and they are best placed to raise it.
Sub-processors and customer promises
If you tell customers you review your sub-processors, expect the auditor to test that claim. Keep the list you publish to customers aligned with your own inventory, and keep the date of the last review. A mismatch between the public list and the internal one is an easy question for an auditor to ask.
Quick check
Do we need a report from every vendor?
No. Apply the process by tier. Low risk vendors may need only a contract and a quick check.
Last reviewed: 19 October 2026.
