Boards do not need to know how many questionnaires the vendor-risk team sent last quarter. They need to know whether the suppliers the business cannot run without are under control, whether known problems are being fixed, whether too much depends on too few providers, and whether the process is slowing the business down. Four questions. Most third-party risk reports answer none of them directly, because they report activity rather than position.
This post proposes a small metric set for the board and a larger one for the team, defines each metric tightly enough that it cannot be quietly gamed, suggests how to set a target, and names the chart that shows it. Examples come from the demo organisation, Northwind Labs, whose vendors are fictional. The targets are illustrative: set your own with your risk committee.
In short
- Report position, not activity. Four board questions: are critical vendors assured, are problems being fixed, how concentrated are we, and how fast is the process.
- Six board metrics are enough. Critical-vendor assurance coverage, overdue critical and high findings, exceptions past expiry, concentration, cycle time, renewals inside the notice window.
- Definitions matter more than numbers. Each metric below says exactly what counts, so closing a finding by downgrading it or re-tiering a vendor shows up.
- Do not report a saturated score. In the demo, most vendors sit at residual 100 because findings are untriaged. That is a team metric, not a board one.
- The data is already there. Insights, the findings queue and the renewal calendar produce these numbers; formal board-reporting templates are planned for 2.0.
Why most vendor-risk reporting misses
Third-party risk reports tend to fill with counts: assessments completed, questionnaires sent, vendors onboarded. They are easy to produce and they always go up. They tell a board that the team is busy, not that the organisation is safer. Worse, they reward the wrong behaviour — more questionnaires, more vendors reviewed lightly — when the job is to look hard at the few that matter.
Regulators have moved towards asking boards to own third-party risk. The US interagency guidance on third-party relationships (June 2023) describes board oversight of the risk management programme and of critical activities. DORA requires the management body of an EU financial entity to approve and review ICT third-party risk policy and to keep a register of information on ICT third-party arrangements. NYDFS 23 NYCRR 500.11 requires covered entities to have a third-party service provider security policy. Confirm with your compliance team what applies to you. The common thread is that the board should see the position, with clear definitions.
data
Industry studies have found that breaches involving a third party are common and rising, and that supply-chain involvement tends to make breaches more costly. Analyst commentary on TPRM has also noted that many organisations discover third-party issues after the initial due-diligence stage, which argues for metrics on monitoring, not just onboarding.
Sources: Verizon Data Breach Investigations Report 2024 and 2025; IBM Cost of a Data Breach Report 2024 (global average about US$4.9M); Gartner commentary on third-party risk management. Exact figures vary by year.
The four board questions
Six board metrics, each answering one of four questions.
The board set: six metrics, defined
| Metric | Definition (what counts) | Illustrative target | Chart |
|---|---|---|---|
| Critical-vendor assurance coverage | Tier 1 vendors with a current SOC 2 Type II (or equivalent) and no expired key document, as a share of all Tier 1 vendors. Tier changes are shown, not netted. | 100%, exceptions named | Single number with the named exceptions |
| Overdue critical and high findings | Open findings of critical or high severity past their due date. A severity downgrade is reported separately. | Zero over 30 days overdue | Bar by vendor tier, trend line |
| Accepted risks past expiry | Findings accepted as risk whose acceptance has expired without renewal or remediation. | Zero | Count with owners |
| Concentration | Share of Tier 1 and 2 spend with the largest vendor; fourth parties shared by several critical vendors. | Within appetite set by the committee | Spend by tier; fourth-party concentration |
| Request cycle time | Median business days from request to decision, by lane, against the lane’s SLA. | Within SLA for each lane | Where requests wait (days per lane) |
| Renewals in the notice window | Contracts whose notice date falls within 90 days and have no renew / renegotiate / offboard decision. | Zero within 30 days | Renewal calendar |
Each definition is written to resist gaming. Coverage counts a vendor as covered only if both conditions hold, so an expired document cannot hide behind a current certificate. Overdue findings report downgrades separately, so the number cannot fall because someone relabelled a critical as medium. Concentration is measured on spend and on shared fourth parties, because a portfolio can look diversified at the vendor level and still run on one data centre operator.
What the demo’s numbers say
The demo gives a realistic first look at a programme that has just switched on agent reading. Its fictional portfolio is eight vendors, $690,000 a year under management, fourteen documents (one expired), 88 open findings of which 5 are critical and 21 high, seven monitoring signals, seven contracts worth $660,000 a year, and three renewals with a notice date inside 90 days.
Read against the board set, those figures say something specific. Concentration: about 65% of spend sits in Tier 1, and most of that is one vendor, Stackforge, at $420,000 a year — a fact worth a sentence on its own. Coverage: Ledgerly, Tier 2, has a SOC 1 Type II that expired on 15 September 2026; NimbusDesk has only a SOC 2 Type I with a future-dated audit period. Renewals: Ledgerly’s notice date of 4 November 2026 has already passed, which is exactly the outcome the renewal metric exists to prevent.
Northwind’s fictional portfolio: $690,000 a year, two-thirds of it in Tier 1.
The metric that should not go to the board yet
The obvious candidate — average residual risk — is missing from the board set on purpose. In the demo, six of eight vendors sit at residual 100. That is because the Document agent raised many findings on first read (23 for Stackforge, 21 for Callwave) and open findings add points until the score saturates. A board shown “six vendors at maximum risk” will either panic or, a quarter later, stop believing the chart.
A saturated score is a team metric
When most vendors score 100, the score is measuring the untriaged findings backlog, not supplier risk. Triage first: close, merge or accept findings with an expiry, and tune the weights so severity counts more than volume. Report residual risk upward only once it separates vendors. Until then, report the board metrics above, which are defined on facts — documents, due dates, notice dates — rather than on a composite. Note too that a dedicated board-report template is planned for 2.0 with the regulated pack; in 1.0 the figures come from Insights, the findings queue and the renewal calendar.
The team set: what the vendor-risk lead watches weekly
Below the board set sits a working set. These are the numbers that move the board metrics, and they belong in the weekly meeting, not the quarterly pack.
| Team metric | Why it matters | Where it comes from |
|---|---|---|
| Findings by severity and age, per owner | The backlog behind every residual score | Findings queue |
| Findings raised by agents vs accepted by people | Whether the Document agent is tuned to your playbook | Agent catalogue: applied, approved, rejected, reverted |
| Documents expiring in 60 days | Coverage will fall unless someone asks now | Documents list with validity |
| Assessments sent, pre-filled share, days to answer | Vendor effort and questionnaire waste | Assessments |
| Signals by reaction (note, finding, re-assessment, escalation) | Whether monitoring produces action or noise | Monitoring feed |
| Messages held in the outbox and their age | Agent work waiting on a person | Outbox |
| Tier distribution of new requests | Whether the business is buying more critical services | Requests |
Cycle time: the metric the business cares about
A vendor-risk programme that is safe but slow loses: the business buys around it. Report cycle time honestly and by lane. In the demo, lanes carry SLAs in business days — security 5, privacy 4, legal 5, finance 3, IT 3, business owner 2 — and Insights shows where requests wait. If privacy is consistently the longest lane, the answer may be a better DPA template rather than more reviewers. Count from the moment the request is written, not from when procurement first touches it, or the number flatters the process.
For the CISO
Assurance coverage of Tier 1 and the overdue critical findings list are the two numbers to know cold.
Concentration on one hosting provider or one fourth party is a resilience question, not only a security one.
For the vendor-risk lead
Definitions written down and applied the same way every quarter.
Triage before you report; a saturated residual score stays inside the team.
For the board
Six numbers, each with a definition, a target set by the committee and a trend.
Exceptions named, with owners and dates, rather than averaged away.
Confirm the board wants position, not activity.
Use the table above as a start; record what counts and what does not.
Particularly for concentration and overdue findings.
Before the first report, so residual scores mean something.
From Insights, findings and the renewal calendar; name every exception.
Change them openly; never mid-quarter.
What it adds up to
Six board metrics, defined on facts the system already holds, answer the four questions a board should ask about third parties. The working set below them tells the team what to do on Monday. Neither depends on a composite score until that score has earned its place, and every exception has a name, an owner and a date.
Tell the board where you stand, not how busy you were.
Assured critical vendors, problems being fixed on time, concentration you chose, and a process the business does not route around. Define each so it cannot quietly improve.