Business leaders today are working with less certainty and tighter capacity. The C-Suite Barometer 2026 mid-year pulse shows growth optimism holding at 92%; however, the Confidence Index has fallen eight points to 35%, its lowest reading since 2021. Also, the Investment Index has softened by seven points to 62%. In the U.S. Barometer, transforming IT and technology ranks as the number one strategic priority across industries and company sizes.
What does this mean for leaders paying attention to third-party risk management (TPRM)? Often when capacity is limited, executive attention to this function becomes scarce. The vendors supporting operations and transformation deserve a proportionate share of attention. Further, programs that spread reviewer time evenly across each vendor may have a diluted focus on the vendors that can significantly affect daily operations.
Risk-based vendor tiering may help alleviate this.
What Is Risk-Based Vendor Tiering?
Vendor risk tiering is the process of classifying vendors according to operational, regulatory, cybersecurity, and financial risk so organizations can spend more time focusing on the most critical third parties. This approach also can lighten the load for vendors carrying limited exposure.
A helpful tiering model is scalable and defensible. It begins with a small number of tier levels, usually three as the base (high risk, moderate risk, and low risk) and up to five for complex structures. There also should be a defined set of risk factors that drive tier assignment. Some factors to consider for tiering include:
- Data classification, including sensitivity and volume of personal information, financial data, protected health information, and other regulated categories
- Service criticality, meaning the operational impact if the vendor is unavailable or degraded
- Regulatory exposure, including whether the service touches regulated processes such as financial reporting, patient care, or consumer protection
- Access to systems and networks, particularly persistent, privileged, or remote access
- Financial impact, measured against contract value and downstream financial impact
- Customer reputational impact, including customer-facing services and public visibility
Each factor is scored against documented criteria. The resulting tier drives the depth of due diligence, monitoring cadence, contract requirements, and executive reporting. Tiers should be reviewed at defined intervals and whenever a vendor’s service scope, data access, or subservice arrangements change.
Tiering generally should reflect the inherent exposure of the relationship before considering the effectiveness of the vendor’s controls. A control weakness identified during due diligence may require remediation, acceptance, escalation, or additional monitoring. Keeping inherent tier assignment separate from control findings helps make the model easier to explain and apply consistently. Below are examples of risk-based vendor tiering.
| Tier | Illustrative Exposure | Illustrative Program Response |
|---|---|---|
| Tier 1: Critical | Failure could materially interrupt critical operations, affect regulated services, or expose significant sensitive data | Enhanced due diligence, evidence validation, specialized reviews, stronger contract provisions, frequent monitoring, executive reporting, and incident-response coordination |
| Tier 2: High | Significant data, system, regulatory, financial, or operational exposure | Expanded due diligence, defined contract protections, periodic monitoring, and formal reassessment |
| Tier 3: Moderate | Limited but meaningful exposure | Targeted questionnaire, proportionate documentation, periodic attestation, and event-based review |
| Tier 4: Low | Minimal access, dependency, or regulated-data exposure | Streamlined intake, basic contractual terms, and simplified periodic confirmation |
*Tiering Example: This article does not prescribe one universal tier definition; your organizations should establish thresholds based on your own risk appetite and operating environment.
Where Do Programs Get Stuck?
Common areas that tend to slow down progress are consistent across sectors.
Static Risk Assumptions: Geographic exposure, AI use, subcontractor dependencies, and infrastructure concentration can change after onboarding. A tiering model that only considers the information collected at intake may not reflect the vendor’s current exposure.
Trusted But Not Verified: A vendor’s “yes” response to a security questionnaire may not demonstrate that a policy or control operates as described. Higher-tier relationships should have defined evidence expectations, particularly for emerging or rapidly changing risks.
From these common areas, the following issues may cascade across the program:
- Too Many Factors: Programs that try to capture every risk dimension often produce a model that’s difficult to apply consistently.
- Inconsistent Scoring: Without defined standards, business owners may interpret criteria differently and find that tier assignments drift over time.
- Tiers Disconnected From Action: Tiers should provide the baseline for the depth of due diligence, monitoring frequency, or contract requirements.
- Cyber-Only Tiering: The model focuses on cybersecurity but does not account for operational, financial, regulatory, or reputational exposure.
Fortunately, adjusting these programs usually calls for a modest rebuild rather than a full overhaul.
A Real-World Example With a Global Manufacturer
Professionals from Forvis Mazars recently supported a global manufacturer with more than a thousand active vendors and a queue of hundreds waiting for onboarding review. The existing program gave each vendor a robust questionnaire and a full SOC or independent assessment review. Plant operations owners had started routing around the process to keep production lines moving. Our professionals helped the organization’s leadership introduce a four-tier model driven by data access, service criticality (including production continuity), and regulatory exposure. Tier 1 vendors, roughly 10% of the population, received deeper due diligence, quarterly monitoring, and formal executive reporting. Tier 4 vendors received a lightweight intake and annual attestation. Onboarding time dropped considerably, reviewer workload rebalanced toward the highest-risk vendors, and executive reporting aligned with the vendors that impacted the plants the most.
Considerations for Building a Vendor Risk Assessment Framework
Tiering is intended to drive program behavior. Here are areas to consider:
- Due diligence depth varies by tier, with defined evidence expectations for each level.
- Contract requirements also vary by tier, including audit rights, incident notification timelines, and subservice organization oversight.
- Monitoring cadence varies by tier, with continuous monitoring reserved for the highest-risk relationships, while lower-risk vendors may be reviewed through periodic attestations.
- Executive reporting focuses on vendors in the top tier(s), so leadership attention aligns with material exposure.
- Reassessment triggers are defined, so tier assignments respond to scope changes, incidents, regulatory shifts, mergers or acquisitions, critical-subcontractor changes, new AI use, and material geographic changes.
- Exception governance should document who may override a calculated tier, the business justification, approval requirements, expiration date, and reassessment expectations.
- Model governance should establish ownership, review frequency, version control, scoring validation, and a process for determining when new risks require a factor, modifier, or reassessment trigger.
How Forvis Mazars Can Help
If your organization is looking to refresh its vendor risk assessment framework, here are some helpful tips.
- Assess your current vendor population and identify how many vendors may have requirements and thresholds that are disproportionate to their risk.
- Consider the appropriate number of levels for the organization, driven by a small number of clearly defined factors.
- Connect tiers to action, so that due diligence depth, monitoring cadence, contract terms, and reporting make sense.
- Train business owners and reviewers on consistent application.
- Measure results, including onboarding time, reviewer workload, and coverage of your highest-risk vendors.
IT Risk & Compliance professionals at Forvis Mazars work with organizations across manufacturing, financial services, healthcare, and other sectors to design tiering models that are practical, scalable, and defensible. Whether you’re building a program, refreshing a mature one, or considering co-sourced or outsourced delivery, we can help you assess the maturity of your TPRM program so you can focus your attention on your most critical vendors.
Connect with us today to ask your questions and gain a fresh perspective on risk-based vendor tiering.