Learn how to turn supplier security findings into residual risk assessments, select appropriate treatment actions, manage risk acceptance and prepare evidence-based recommendations. Includes a worked supplier approval case and practical risk decision exercise.
Imagine you are a GRC analyst at Meridian Financial Services, a fictional UK financial technology company.
The organisation is preparing to onboard a new cloud hosting supplier.
You have already completed the supplier's criticality classification, inherent risk assessment and security due diligence.
Your review identified the following:
The Operations Director wants to know:
"Can we approve this supplier and proceed with implementation?"
How should you respond?
Should you automatically reject the supplier because a control weakness exists?
Should you approve it because a remediation plan has been provided?
Can you reduce the residual risk rating based on controls the supplier has promised to implement?
These are the decisions that make Third-Party Risk Management more than a questionnaire exercise.
Your responsibility as a GRC analyst is to evaluate the evidence, explain the remaining risk, recommend suitable actions and ensure the decision reaches the appropriate authority.
This guide explains how to perform those activities.
A supplier risk finding is a documented observation arising from an assessment that requires attention because it may affect a control requirement, the organisation's exposure or the confidence available to make a decision.
Findings can arise from:
Not every finding represents a confirmed security failure.
| Finding type | Meaning |
|---|---|
| Confirmed control weakness | Evidence shows a required control is missing or ineffective |
| Evidence gap | Available information does not adequately demonstrate a relevant control |
| Control exception | A deviation from an expected control requirement or operation |
| Contractual gap | Required terms or responsibilities are missing or unclear |
| Unresolved dependency | A material subcontractor or operational dependency has not been adequately assessed |
| Improvement opportunity | A potential enhancement identified without necessarily establishing a current breach |
The distinction matters because each finding may require a different response.
For example, missing MFA evidence is not the same as evidence confirming that MFA is absent.
The former creates assurance uncertainty. The latter establishes a control weakness.
Both may affect the organisation's ability to approve the supplier, but they should be recorded accurately.
A finding describes an observed condition.
A risk statement explains what could happen because of that condition and what the consequences might be.
Finding:
Three privileged production accounts do not enforce MFA.
Related risk statement:
Because privileged production accounts lack the required additional authentication protection, compromise of an affected account could enable unauthorised administrative activity, potentially resulting in service disruption, information exposure or unauthorised changes.
The finding describes the verified weakness.
The risk statement describes the uncertain event and potential consequences.
Without a risk statement, management may know that a control is deficient but not understand why the deficiency matters.
The analyst should connect the observation to:
The same finding can contribute to more than one risk scenario.
For example, weak privileged access protections may contribute to both confidentiality and availability risks.
Conversely, one risk scenario may be affected by several control findings.
A good register should support these relationships without unnecessarily duplicating records.
Residual supplier risk is the exposure remaining after the effects of relevant controls have been considered.
In an earlier lesson, you assessed inherent supplier risk before accounting for safeguards under the fictional Meridian methodology.
You then reviewed supplier controls and their supporting evidence.
Now you must determine what exposure remains.
| Risk state | Meaning |
|---|---|
| Inherent risk | Exposure before considering relevant safeguards under the defined methodology |
| Current residual risk | Exposure remaining under controls currently operating |
| Target risk | Expected exposure after proposed improvements become effective |
These states should not be confused.
A supplier's commitment to improve its controls may support a treatment plan and a target assessment.
It does not establish that the current exposure has already decreased.
Suppose a cloud supplier presents a high inherent risk of unauthorised administrative access.
The supplier has implemented network restrictions, least-privilege permissions and activity monitoring.
However, relevant privileged accounts still lack MFA.
The current residual risk assessment should reflect the controls actually operating, along with the identified MFA deficiency.
If MFA is later implemented and appropriately verified, the risk can be reassessed.
Current residual risk must not be reduced solely because a remediation action has been promised.
A practical process involves six steps.
Retrieve the original risk statement, likelihood and impact assessment.
Confirm that the scenario remains relevant.
If the scope or nature of the supplier relationship has changed materially, reconsider the inherent assessment before proceeding.
Determine which safeguards address the likelihood or consequences of the scenario.
For unauthorised privileged access, controls might include:
Use the control assessment results from the preceding lesson.
Determine which controls are adequately supported, partially supported, ineffective or not assessed.
Do not assume that every documented control operates effectively.
Where important evidence is missing, document how the uncertainty affects confidence in the assessment.
An organisation may apply conservative assumptions under its approved methodology.
However, it should not present an unverified control as either definitely effective or definitely absent.
Evaluate how the currently operating controls affect the original risk scenario.
For example, effective preventive controls may reduce the assessed likelihood.
Effective containment and recovery arrangements may reduce certain consequences.
Not every control changes both dimensions.
Document:
The numerical result should follow the organisation's approved methodology.
Meridian Financial Services is evaluating CloudCore Infrastructure.
The risk scenario concerns unauthorised privileged access to production hosting systems.
Meridian uses an illustrative five-by-five risk matrix.
| Control | Finding |
|---|---|
| Least privilege | Supported by relevant evidence |
| Administrative logging | Implemented and operating within reviewed scope |
| Privileged access reviews | Supported, with one historical exception addressed |
| MFA | Confirmed weakness affecting three accounts |
| Incident response | Relevant documented procedure and tested arrangements |
The controls provide some risk reduction, but the MFA weakness remains significant.
The assessment team provisionally concludes:
The impact remains Severe because unauthorised privileged activity could still have substantial consequences.
The likelihood is reduced to Possible based on the controls supported by evidence.
These values are illustrative professional judgements within a fictional assessment methodology, not automatically calculated effects of individual controls.
CloudCore commits to enforce MFA on the three affected accounts within thirty days.
If the corrective action is completed and verified, the team estimates that the target likelihood could reduce to 2.
With the impact remaining 5:
Target risk score = 2 × 5 = 10 (Moderate).
However, the current residual score remains 15 until relevant control improvements have been implemented, verified and the assessment is formally updated.
| Assessment | Likelihood | Impact | Score | Status |
|---|---|---|---|---|
| Inherent | 4 | 5 | 20 | Baseline assessment |
| Current residual | 3 | 5 | 15 | Present exposure |
| Target | 2 | 5 | 10 | Expected after verified treatment |
The target assessment does not replace the current residual assessment.
An organisation's risk appetite helps determine which exposures it is prepared to retain in pursuit of its objectives.
Risk tolerance and escalation thresholds provide further boundaries or operating limits within the organisation's framework.
Suppose Meridian's approved, fictional policy establishes:
CloudCore's current residual risk is High.
Therefore, it exceeds Meridian's normal risk appetite.
The GRC analyst should clearly record the breach and refer it through the approved escalation process.
Not necessarily.
The organisation may consider additional controls, restrictions, alternative suppliers or a formally authorised exception where permitted.
Some risks may be unacceptable because of legal, regulatory, contractual or policy requirements, regardless of management's commercial preference.
No.
Acceptance records an authorised decision to retain identified exposure.
It does not eliminate the underlying risk or automatically change the assessment result.
If an organisation allows an exception, the record should show both the appetite breach and the authorised decision.
These are separate facts.
Once residual exposure has been assessed, the organisation must determine the appropriate response.
Four common risk treatment approaches are:
Avoid the exposure by not proceeding with the activity or changing the proposed arrangement.
For example, Meridian may decide not to onboard a supplier that cannot satisfy essential security requirements.
Implement additional safeguards to reduce the likelihood or consequences of the risk.
Examples include:
Allocate some consequences or responsibilities through arrangements such as insurance, contractual indemnities or other appropriate mechanisms.
For example, a supplier agreement may assign defined liability for certain failures.
However, contractual allocation does not automatically remove operational dependency, customer harm or the organisation's own regulatory responsibilities.
Formally retain the exposure through an authorised decision after understanding its implications.
Acceptance may be appropriate where the risk falls within approved appetite, or where an authorised exception is available and justified.
It should not be used to bypass mandatory obligations or the organisation's approval process.
A practical treatment recommendation considers:
The cheapest treatment is not necessarily the most appropriate.
A treatment plan turns recommendations into accountable actions.
For each action, the analyst should record:
| Field | Description |
|---|---|
| Risk reference | The scenario being treated |
| Finding reference | Relevant control weakness or assurance gap |
| Treatment approach | Avoid, reduce, transfer/share or accept |
| Required action | Specific, measurable activity |
| Responsible owner | Person accountable for delivery |
| Target date | Agreed deadline |
| Completion criteria | Conditions defining satisfactory completion |
| Verification evidence | Information needed to confirm the outcome |
| Current status | Not started, in progress, blocked or completed |
| Target risk | Expected exposure after successful treatment |
| Escalation trigger | Conditions requiring additional management attention |
Risk ID: TPR-014
Finding: MFA is absent on three privileged production accounts.
Treatment: Reduce.
Action: Enforce MFA for all in-scope privileged production accounts and resolve or formally authorise any applicable exceptions.
Delivery owner: CloudCore Security Manager.
Internal relationship owner: Meridian Head of Infrastructure.
Target date: Thirty days after formal agreement.
Verification: Relevant production configuration and account coverage evidence reviewed by Information Security.
Current residual risk: High.
Target risk: Moderate, subject to successful verification and reassessment.
Escalation: Any missed deadline or material increase in exposure must be referred to the designated risk authority.
The action should not be closed based solely on the supplier stating that remediation is complete.
Verification must be appropriate to the finding.
Risk acceptance is a documented decision to retain an identified exposure.
In a supplier context, it may arise when:
Acceptance should be informed, justified and authorised.
At minimum:
Meridian cannot immediately replace CloudCore because the supplier hosts its production service.
The business requests a thirty-day exception while MFA remediation takes place.
The GRC analyst prepares a decision record explaining the current exposure and outstanding weakness.
The authorised decision-maker considers the business dependency, risk, feasible restrictions, remediation timetable and applicable requirements.
If the exception is approved under the organisation's governance framework, the risk remains recorded as High until reassessment supports a change.
The acceptance should also have clear conditions and review arrangements.
Risk acceptance is a governance decision, not a control that eliminates risk.
Some organisations permit conditional approval where defined outstanding issues must be resolved.
This can be useful when a supplier relationship has significant business value but certain assurance matters remain incomplete.
However, conditional approval should not become an informal way to avoid risk review.
Meridian might require:
Conditions should be specific, measurable and enforceable through the appropriate governance or contractual arrangements.
A supplier can receive approval to proceed subject to conditions, while individual risk decisions remain subject to separate authorities.
The record should clearly explain:
For a serious weakness, the appropriate condition may be to prohibit production access until remediation is verified.
Conditional approval should not be interpreted as permission to bypass that restriction.
Different roles contribute to risk management, but their responsibilities are not interchangeable.
| Stakeholder | Typical responsibility |
|---|---|
| Business risk owner | Owns exposure arising from the business relationship |
| Supplier relationship owner | Coordinates the relationship and supplier commitments |
| GRC analyst | Evaluates findings, documents risk and recommends actions |
| Information Security | Reviews technical control evidence and remediation |
| Procurement | Coordinates supplier management and relevant commercial processes |
| Legal and Compliance | Advises on applicable obligations and contractual implications |
| Designated risk authority | Approves acceptance, exceptions or escalation decisions within delegated authority |
Suppose the Operations Director says:
We have already committed to this supplier. The business cannot afford a delay. Just approve it.
The analyst should not ignore the commercial consequences.
However, the analyst should also avoid providing assurance that the evidence does not support.
A suitable response might be:
The supplier has a confirmed privileged-access weakness, and the current residual risk exceeds our normal appetite. We can outline the available treatment options, implementation restrictions and required approvals. I recommend presenting these to the authorised risk owner so that a documented decision can be made.
This communicates the issue without assuming that the analyst has sole authority to stop or approve the relationship.
Where a mandatory requirement is implicated, the appropriate legal, regulatory or compliance advice must also be obtained.
Let's bring the assessment together.
Supplier: CloudCore Infrastructure
Service: Production cloud hosting
Criticality: High impact
Business owner: Head of Infrastructure
Scenario: Unauthorised privileged activity could compromise production services or customer information.
Inherent risk: Critical, score 20.
Current residual risk: High, score 15.
Target risk: Moderate, score 10, after verified remediation.
The business wants production migration to begin in two weeks.
The supplier expects MFA remediation to take thirty days.
The risk exceeds Meridian's normal appetite.
This would leave the organisation exposed to a known privileged-access weakness.
It should not be recommended without an appropriate, properly authorised risk decision, and it may be impermissible under applicable requirements.
Meridian could defer production migration or privileged access until MFA remediation has been verified.
This reduces the need to expose production systems to the known weakness.
The business impact of the delay should be assessed.
If technically feasible and permitted under the applicable governance framework, Meridian could consider tightly restricted access, additional monitoring and an authorised temporary exception.
The effectiveness of any compensating measures must be assessed.
The existence of proposed compensating controls does not by itself establish that the risk is acceptable.
CloudCore presents a High current residual risk arising from a confirmed privileged-access weakness. The risk exceeds Meridian's normal appetite. I recommend withholding the affected privileged production access until MFA remediation has been independently verified. If the business proposes an alternative interim arrangement, its controls, consequences and applicable obligations should be assessed and submitted to the designated risk authority for a documented decision. The current residual rating should remain unchanged until evidence supports reassessment.
This recommendation balances the business context with the evidence and governance requirements.
It does not claim that the analyst independently has authority to accept the risk.
A decision record should make the reasoning and authority clear.
| Field | Example |
|---|---|
| Supplier | CloudCore Infrastructure |
| Service | Production cloud hosting |
| Business owner | Head of Infrastructure |
| Risk ID | TPR-014 |
| Risk statement | Unauthorised privileged activity could compromise production services |
| Inherent risk | Critical — 20 |
| Current residual risk | High — 15 |
| Risk appetite status | Exceeds normal appetite |
| Material finding | Three privileged accounts lack MFA |
| Proposed treatment | Remediate MFA and restrict affected production access |
| Target risk | Moderate — 10, subject to verification |
| GRC recommendation | Do not enable affected privileged production access until verified treatment or properly authorised alternative |
| Decision authority | Designated risk authority |
| Decision | Pending |
| Review trigger | Remediation verification, deadline breach or material service change |
This type of record demonstrates why a decision is being considered and what must happen next.
For the future TPRM Toolkit, the decision record should link to the risk register, control findings, treatment tracker and acceptance register.
Risk management does not end when a supplier agrees to remediate a finding.
The organisation must confirm progress and determine whether the desired outcome has been achieved.
First: Supplier reports that MFA remediation is complete.
Second: Relevant security personnel review the implementation evidence.
Third: The reviewer checks whether all affected privileged accounts are covered and whether exceptions remain.
Fourth: GRC updates the finding record based on the verified results.
Fifth: The risk assessment team re-evaluates current residual risk.
Sixth: The accountable decision-maker reviews any change requiring approval.
A closed finding does not automatically mean the whole supplier relationship is low risk.
Other risk scenarios and dependencies may remain significant.
The analyst should:
Repeated missed deadlines may justify additional restrictions or reconsideration of the supplier relationship.
You are a junior GRC analyst at Meridian Financial Services.
The company is assessing SupportBridge, a fictional customer support SaaS provider.
The service will handle customer records and connect to Meridian's internal customer relationship management system.
The assessment has established the following.
Risk scenario: Unauthorised access to the customer support platform could expose customer information and allow inappropriate access to connected systems.
The assessment team proposes:
The supplier agrees to enforce MFA for the remaining administrative accounts and provide evidence within twenty-one days.
Meridian's fictional policy requires escalation for High residual risks.
Prepare a supplier risk recommendation containing:
Risk statement
Because two supplier administrative accounts lack MFA, compromise of those accounts could enable unauthorised privileged activity affecting customer information or connected systems.
Findings
The MFA deficiency is confirmed. API restrictions and logging provide relevant safeguards, while the access review exception requires further evaluation.
Current residual risk
High, score 12, based on the fictional methodology and the assessment team's documented judgement.
Treatment
Require MFA remediation for the affected accounts. Consider withholding affected privileged access until the requirement is met.
Target risk
A lower target rating may be proposed if verified remediation materially reduces likelihood. The exact target should be determined through reassessment, rather than assumed from completion of a single action.
Governance
Refer the material exposure and any proposed exception to the designated risk authority. The business owner remains accountable for the relationship.
Verification
Obtain suitable evidence showing MFA coverage for the affected accounts and assess the outstanding access review exception.
Monitoring
Track the remediation deadline, exceptions, supplier changes and any material security events affecting the relationship.
| Criterion | Marks |
|---|---|
| Risk statement and findings | 20 |
| Residual risk reasoning | 20 |
| Treatment recommendation | 20 |
| Risk appetite and decision authority | 15 |
| Verification and monitoring | 15 |
| Clarity of management recommendation | 10 |
| Total | 100 |
The model response is illustrative. Alternative recommendations may be defensible where they are supported by evidence and comply with the fictional governance requirements.
Planned improvements inform target risk, not current exposure.
The significance of a finding depends on the relevant risk, scope, evidence and business consequences.
Insufficient assurance is not the same as demonstrated control failure.
Acceptance authorises retention of exposure; it does not eliminate the risk.
An authorised exception should be recorded separately from the risk's assessed appetite position.
Decision-makers should understand material uncertainty and outstanding obligations.
A contract may allocate some consequences, but cannot remove every dependency or responsibility.
A supplier's completion statement may need to be supported by evidence.
The analyst should know who can approve, accept or escalate the relevant risk.
Treatment plans require monitoring, accountability and defined escalation.
Before presenting a supplier risk recommendation, confirm:
Supplier findings should be evaluated according to their relevance, evidence and potential business consequences.
Residual supplier risk reflects exposure remaining after relevant existing controls are considered.
Target risk reflects the expected position after planned treatment becomes effective.
The four common treatment approaches are to avoid, reduce, transfer or share, and accept risk.
Risk acceptance requires proper authority and does not remove the underlying exposure.
Conditional supplier approval should include clear restrictions, ownership, timelines and monitoring arrangements.
GRC analysts should provide evidence-based recommendations while preserving the organisation's defined decision-making responsibilities.
A strong supplier risk assessment does not end with a score. It explains the exposure, the options available and the decision that management needs to make.
Next lesson: Security Requirements in Third-Party Contracts
You have learned how to assess remaining supplier risk, recommend treatment and support risk acceptance or approval decisions.
The next lesson will explain how relevant security, privacy, incident notification, assurance and exit requirements can be incorporated into supplier agreements, and how GRC analysts can support Procurement and Legal during contract reviews.