Vendor Risk Management Checklist (Updated 2023) | UpGuard

This document is a comprehensive guide to vendor risk management, detailing how to conduct VRM audits, establish an operating model (three lines of defense), and implement policies and procedures for risk assessment, vendor management, and ongoing governance (e.g., SOC 2/ISO reviews, security questionnaires). It provides lifecycle guidance across qualification, engagement, information security management, delivery, and termination, with practical checklists for each stage, including due diligence, security controls, and contractual requirements. The piece also highlights UpGuard’s tooling—such as automated questionnaires, benchmarking, and AI Autofill—to streamline vendor assessments and improve the efficiency of third-party risk programs.