The business wants to roll out an AI note-taker. Another team needs a partner integration switched on before a launch. Both are in the security review queue, behind the payroll provider, the catering company and the MSP with domain-admin reach, and every one of them gets the same full questionnaire.
The team calls it consistency. In practice it’s triage by exhaustion. The questionnaire queue sets the pace, low-risk tools stall for no gain, critical vendors wait behind trivial ones, and the vendors that really carry risk get the same skim as everyone else. The business learns to see security as the department of “not yet”.
That’s the depth-at-scale problem. It isn’t that teams don’t care about depth. One-size process uses up the hours depth needs, and holds up the reviews that never needed them.
Vendor risk reviews shouldn’t be what blocks innovation or AI adoption. The fix isn’t to review less or wave vendors through. Reviews that keep pace with the business and reviews that get the answer right come from the same discipline: effort that follows risk, with people approving the risk decisions.
A regulator just said the quiet part out loud
On September 11, 2026, the OCC, Federal Reserve, FDIC, and NCUA proposed new interagency third-party risk management guidance for banks and credit unions. It is a proposal, it is non-binding, and comments are open until November 16. Its direction is still worth reading outside banking.
The agencies say they want to help institutions align practices “in relation to reasonably assessed risk levels specific to each of their third-party relationships,” while “avoiding overly process-driven strategies that treat all third-party relationships as inherently higher-risk” (Federal Register notice of the proposed guidance).
Once the guidance is final, the agencies say they plan to replace the existing third-party guidance with it “to promote consistency and prudent innovation in the banking industry.”
For a TPRM owner, that reads less like permission to do less and more like a challenge: show that your effort follows risk, not paperwork volume, so review stops being the thing innovation waits on. It’s a signal for regulated teams, not compliance advice, and it isn’t a regulator endorsing speed for its own sake.
Tailoring is not the same as thinning
Teams hear “risk-based” and reach for a shorter questionnaire for low tiers. That’s fine as far as it goes, as long as everyone is clear on one thing: light means proportionate, not absent. A low-tier vendor still gets reviewed, on a documented light path with clear exit criteria. Anything that touches regulated data or privileged access goes up a tier. The harder half is what happens at the top.
- Tiering by contract value misses the real exposure. A low-cost tool with privileged access, or an MSP that administers a vendor’s systems, can matter more than a big-ticket supplier with no data access. Tier on data, access, and operational dependency.
- Depth means different questions, not more of them. A critical vendor deserves questions about its stack: who manages it, which integrations reach your data, what changed since last review. Not a longer list of generic controls.
- Risk changes between reviews. A tier set at intake goes stale when a KEV lands in the vendor’s tooling or a new integration is switched on. Tailoring has to be re-openable. That’s the lesson of Remediation theater.
- Evidence beats affirmation at the top tier. For the vendors that matter most, a checkbox answer is a starting point. Check it against what you can see from outside, as in Green questionnaires, live exposure.
What tailored depth looks like in practice
- Write down your tiering logic in terms a reviewer can follow: data sensitivity, access level, operational dependency, substitutability. If you can’t explain why a vendor is in a tier, the tier isn’t risk-based.
- Build question sets per relationship type, not one master template. Payment processors, MSPs, data-processing SaaS, and professional services get different deep-dive modules.
- Spend the saved hours at the top. Shrinking low-tier reviews only helps if that time moves to critical vendors: fourth-party mapping, evidence checks, follow-up.
- Set re-tier triggers: a new integration, a scope expansion, a KEV or breach in the vendor’s class, an ownership change.
- Keep decisions with people. Automation and agents can draft tailored questions, collect evidence, and chase answers. Tiering exceptions and residual-risk acceptance stay with accountable humans.
Who feels this
TPRM leads feel it as queue pressure: everything is urgent, so nothing is deep.
Security feels it as misplaced effort: critical vendors get the same review as stationery suppliers.
Legal and compliance feel it as defensibility: “we sent everyone the same form” is a weak answer when someone asks why a critical relationship got a light touch.
A one-week depth check
- List your top ten vendors by access and data, not spend. Does that list match your top tier?
- For each, what did your last review ask that a low-tier vendor wasn’t asked?
- Which of them had a material change (new integration, new provider, KEV in their tooling) since last review, and did anyone re-tier them?
- How many hours last quarter went to low-tier questionnaires versus critical-vendor follow-up?
- Could you explain your tiering logic to an auditor in plain terms, without opening the template?
If the answers point the wrong way, you don’t need a longer questionnaire. You need a different allocation.
Where this fits
Rescana works on this allocation problem in third-party and supply chain risk. Prism tailors questions to each vendor relationship, checks vendor answers against live exposure, and keeps follow-up moving until there’s evidence, with people approving the risk decisions. The goal is reviews that don’t block the business and findings the risk owner can stand behind: depth where it matters, proportionate effort everywhere else.
Further reading
Earlier practice notes: Green questionnaires, live exposure: why TPRM owners still get surprised after a KEV week, The vendor left. Your data didn’t. Post-engagement risk as a TPRM blind spot, Remediation theater: the ticket closed, the exposure didn’t, and Your vendor patched. Their MSP didn’t: fourth-party risk after a KEV week.
Soft next step
If you’re rethinking how your program tailors depth so vendor reviews stop blocking the business, whether or not your sector’s regulators are asking yet, we’re glad to compare notes on how regulated teams are rebalancing effort toward the vendors that matter.
