Case studies / Third-party risk
Simulated case study: fictional company (Northstar Financial Technologies), synthetic data, no real audit or client.
3. Third-party risk assessment and remediation program
Three vendor cases: Stratwick (Tier 1, residual High, conditionally approve); Pinebrook (Tier 3, residual Medium, conditionally approve); Lumenvale (Tier 2, residual High, restrict). The tracker holds 20 issues, 5 overdue.
Why it matters to the business
The business context. Northstar's services depend on outside parties: its vendor inventory lists 9 suppliers. The most important, Stratwick Managed Hosting Inc., supplies “Managed database hosting and disaster-recovery site for the payments environment”. The service is rated Critical, it holds Restricted data, it has privileged connectivity, it is hard to replace, and its contract ends on 2027-03-31, so a renewal decision is coming.
What is at stake. The register scores “Critical vendor failure” (R-06: 15 out of 25 before controls, recorded residual 8) and “Vendor data exposure” (R-07: 12 out of 25 before controls, recorded residual 9). A company can outsource a service but not its accountability. If a vendor's independent assurance report stops months short of today, or a security certificate is claimed but cannot be produced, the recorded residual score is not supported, and no one is told. Reviewing every vendor in depth is impossible, so the real question is where to spend effort and how to judge the evidence that comes back.
Who relies on the work. The Head of Procurement runs the process. The Head of Payments Engineering owns the critical relationship. The Chief Risk Officer accepts the residual risk for the most important vendors. Each needs a decision they can defend: approve, approve with conditions, restrict or reject, with the conditions, owners and dates written down.
What the business needs from this work.
- Effort in proportion to risk, through a transparent tiering method rather than treating every vendor alike.
- A judgement about how reliable each piece of evidence is (independently verified, verified with limits, self-reported or missing), not a count of questionnaires returned.
- Issues tracked to closure with ageing and escalation, so a gap does not sit open until the renewal.
What this shows about how I work. It reads vendor evidence critically, distinguishes inherent from residual risk, links the vendor's gaps to the customer's own controls, and turns a due-diligence pack into a decision with conditions. That goes well beyond collecting questionnaires.
Approach
Tier is a transparent score of six ordinal factors (criticality and data sensitivity weighted double; privileged connectivity, concentration, regulatory relevance and substitutability weighted once), with override rules. Inherent risk comes from tier; residual risk comes from evidence: each required evidence area is rated by how reliable it is (independently verified, verified with limitation, self-reported or missing), and the number of weak areas moves residual risk down, hold or up one level. Decisions carry conditions with owners and dates, and every issue is tracked with age, overdue days and an escalation level.
What is automated, and what is not
Automation here means scripts that run the same way every time on synthetic data. It is not a live connection to any real system. The table separates what a script does from what still needs judgement.
| What is automated | How | Where in the repository | What a person still does |
|---|---|---|---|
| Vendor tier | A weighted score of six factors with override rules gives Tier 1, 2 or 3 | scripts/build_p3.py, p3_config.py | Choosing the factor weights and the override rules |
| Residual risk | The count of weak evidence areas moves residual risk down, holds it or raises it one level | scripts/build_p3.py | Rating how reliable each piece of vendor evidence is |
| The remediation tracker | Age, overdue days and escalation level for 20 issues are calculated from the dates and the written escalation rule | scripts/build_p3.py | Chasing the vendor and validating the closure evidence |
| Packs and the questionnaire | Three assessment packs, decision memos and a questionnaire workbook with drop-down answers are generated | scripts/build_p3.py | Writing the conditions and the decision rationale |
Re-run it. bash scripts/build_all.sh rebuilds everything from the synthetic data in 22 steps and runs 92 automated tests. The single script is named in each row.
Vendor decisions
| Stratwick Managed Hosting Inc. | Tier 1 | High | High | Conditionally approve |
|---|---|---|---|---|
| Pinebrook Print and Mail Ltd. | Tier 3 | Low | Medium | Conditionally approve |
| Lumenvale AI Ltd. | Tier 2 | Medium | High | Restrict |
No rows match the current filters.
Stratwick (V-01) is the critical hosting provider: its independent assurance report leaves 2026-04-01 to 2026-09-30 uncovered and excludes the disaster-recovery site, so residual risk stays High. Pinebrook (V-02) is a low-criticality print vendor whose inherent risk is Low but whose residual risk rises to Medium because 22 questionnaire questions went unanswered and a claimed ISO/IEC 27001 certificate was not produced. Lumenvale AI (V-03) is restricted because its retention and training terms are unconfirmed.
Remediation tracker
| TPR-001 | V-01 | Independent assurance report | High | Open | 13 | No | None |
|---|---|---|---|---|---|---|---|
| TPR-002 | V-01 | Access control | High | In progress | 13 | No | None |
| TPR-003 | V-01 | Access control | High | In progress | 13 | No | None |
| TPR-004 | V-01 | Subcontractors and subprocessors | High | Open | 13 | No | None |
| TPR-005 | V-01 | Business continuity and recovery | High | Open | 13 | No | None |
| TPR-006 | V-01 | Penetration testing | High | Closed | 8 | No | None |
| TPR-007 | V-02 | Independent assurance report | Low | Open | 44 | Yes | Head of Procurement |
| TPR-008 | V-02 | Retention and deletion | Medium | Open | 13 | No | None |
| TPR-009 | V-02 | Subcontractors and subprocessors | Medium | Open | 44 | Yes | Head of Procurement |
| TPR-010 | V-02 | Business continuity and recovery | Low | Closed | 40 | No | None |
| TPR-011 | V-02 | Access control | Medium | Open | 13 | No | None |
| TPR-012 | V-03 | Independent assurance report | High | Open | 13 | No | None |
| TPR-013 | V-03 | Retention and deletion | High | Open | 13 | No | None |
| TPR-014 | V-03 | Subcontractors and subprocessors | High | Open | 44 | Yes | Head of Procurement |
| TPR-015 | V-03 | Incident notification | High | Open | 13 | No | None |
| TPR-016 | V-03 | Business continuity and recovery | High | Open | 44 | Yes | Head of Procurement |
| TPR-017 | V-03 | Penetration testing | Low | Open | 44 | Yes | Head of Procurement |
| TPR-018 | V-03 | Model training and data use | High | Open | 13 | No | None |
| TPR-019 | V-03 | Access control | High | Open | 13 | No | None |
| TPR-020 | V-03 | Encryption | High | Open | 13 | No | None |
No rows match the current filters.
What management should do
Obtain a bridge letter from Stratwick as a condition of the renewal discussion, confirm that Northstar's own leaver and MFA findings (the user-entity controls it must operate) are closed, and hold Lumenvale to written retention and no-training commitments before any use case depends on it (see Project 4).
Uncertainty and limitations
- Only 3 of 9 inventory vendors were assessed. Vendor documents are synthetic and no real vendor is represented.
- The scoring is a transparent ordinal heuristic, not a validated model; the assumptions that would change each rating are listed in the vendor risk register.
Downloads
Every file below is generated by this repository's scripts and listed in the download index.
- Tiering methodologyPDF · 8 KB
- Assessment pack: Stratwick (V-01)PDF · 11 KB
- Assessment pack: Pinebrook (V-02)PDF · 9 KB
- Assessment pack: Lumenvale AI (V-03)PDF · 10 KB
- Vendor decision memosPDF · 10 KB
- Due-diligence questionnaire workbookXLSX · 10 KB
- Vendor risk register (CSV)CSV · 2 KB
- Remediation and monitoring tracker (CSV)CSV · 10 KB
Sources
- S001: The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29) (NIST), verified
See the full source register.