RANT Roundtable in partnership with Diligent

'From ticking boxes to managing risk: Why teams must think beyond supplier questionnaires'

Supplier questionnaires are still the primary mechanism for assessing and managing third-party risk. But there’s good reason to be sceptical about their efficacy. Were the questions you posed clear, concise and relevant? And can you really trust the answers? And then there’s the resource challenge. Security teams are drowning in questionnaires, lacking the time and capacity to thoroughly review hundreds of generic responses. Critical risks get lost in a sea of tick-box compliance exercises.

But perhaps the biggest missed opportunity is treating questionnaires as a compliance endpoint rather than a collaboration starting point. The goal shouldn’t be to simply collect completed forms and file them away. Instead, questionnaires should open a dialogue – a chance to understand your supplier’s actual security posture, identify gaps together, and work collaboratively to strengthen defences on both sides.

That’s not to say questionnaires aren’t useful. When used correctly, they can provide a great starting point for third party risk management initiatives. But equally they’re not a silver bullet.

A better way may be to complement security questionnaires with other assessment methods, such as real-time news monitoring, security ratings, and on-site visits. By combining multiple data sources, it’s possible to build a more accurate, multi-layered view of third-party risk.

It’s time to reduce compliance grind and focus on managing risk. Join Diligent and a select group of cybersecurity and risk leaders for an evening of insight and discussion. Hear how your peers are managing the challenges of TPRM. And how AI-powered tools can do more of the heavy lifting, to reduce “questionnaire fatigue” and support real-time monitoring.