Your Vendors Are a Risk You Cannot Ignore. Here Is How Boards Should Own It.
Most companies review their suppliers and tick the boxes. Far fewer can say how much financial damage a vendor failure would actually cost them. That gap is the problem.
Key points
- A single vendor failure can trigger legal penalties, insurance gaps and broken operations simultaneously.
- Most organisations build vendor-review programmes but cannot translate those reviews into a clear picture of remaining financial exposure.
- Boards need a concise, numbers-based report on vendor risk, separate from the operational detail that management handles day to day.
- Insurance and indemnity clauses can coexist with serious unprotected exposure on a company's balance sheet.
- Aggregating individual vendor exceptions matters: ten individually acceptable risks in the same system or data category can add up to one unacceptable one.
Every company relies on outside suppliers. A payroll processor. A cloud storage provider. A software platform running the booking system. When one of those suppliers fails or simply goes dark, the damage lands on you.
A piece published by Dark Reading, written by HITRUST founder Dan Nutkis, sets out a practical governance model for exactly this problem. Most companies already run vendor-review programmes: they collect questionnaires and sign contracts with liability clauses. That activity is necessary. It isn't sufficient.
So what is actually missing?
The missing piece is a clear answer to the financial question. After all those reviews, contracts and insurance policies, how much are we still on the hook for if a supplier lets us down?
Nutkis lays out a sequence of steps. First, measure the real leftover risk after every protection is counted. Second, check how much of the supplier base has actually been reviewed, and be honest about whether old or self-reported evidence is good enough. Third, compare that picture against the organisation's stated risk appetite. If the exposure sits outside what leadership agreed to accept, someone should be explaining why.
Exceptions happen. A business deal moves fast and a vendor gets approved before the full review is done. That's fine, so long as someone owns the decision, sets a deadline to fix it, and makes the risk visible rather than burying it in a spreadsheet.
The aggregation point deserves a pause. One vendor handling sensitive data outside normal standards is a manageable exception. Ten vendors, each approved on the same basis, all touching the same billing platform or cloud provider, is a portfolio problem. The individual decisions looked fine. Together they create a concentration of risk that could be genuinely material.
Insurance and indemnity clauses deserve the same scrutiny. A signed contract and a valid insurance certificate feel reassuring. They don't automatically mean the company is protected. Boards should ask what the transferred portion actually covers and what stays on the balance sheet regardless.
Nutkis also argues for benchmarking against peers, a step that's easy to skip but matters because it distinguishes deliberate strategy from unmanaged drift. We covered the related failure mode on 6 July, when security teams struggled to translate technical controls into financial terms that boards could act on.
Should you worry if your data is inside one of these chains?
You can't control how your bank or hospital manages its vendors. Watch for unusual account activity after any supplier breach is announced, and take notification letters seriously when they arrive.
For the organisations themselves, the message is that activity and governance aren't the same thing. Counting completed reviews is activity. Knowing the residual financial exposure is governance. Boards need the second one, reported separately from the operational detail, and in numbers they can actually defend.
