Our bank just went through development of a Vendor Management Program that required us to complete risk assessments on our vendors; we completed them for each individual vendor. It was suggested to us, although all vendors play an important role, some are deemed more critical than others and we need to really address the risk associated with those critical vendors. We completed a thorough risk assessment on all critical vendors and have plans to complete them for other vendors in upcoming months.
I think the third party risk assessment Jack provided is a great start in determining overall third party risk to the bank and then more steps would be taken to further assess the more “critical” vendors that may be driving the “moderate” to “high” categories.