What do you do when a supplier pushes back on a risk assessment?

I’ve seen this firsthand. You ask a supplier to complete a risk assessment, and they push back. I’ve had that response from large enterprises and smaller businesses alike.

So, what now?

One option is to wait until the supplier’s contract comes up for renewal and add a clause requiring them to participate. That sounds straightforward enough. But what if you’re dealing with a much larger supplier that has little incentive to change its terms? Or a supplier that knows how difficult it would be for you to replace them? You could spend months negotiating and still be no clearer about the risk to your business.

Another option is to rely on external intelligence. These services can alert you to a cyber incident, a reputational issue or a governance concern involving a supplier. Those alerts are useful. But if the first time you ask how an incident could affect your business is when the alert arrives, it’s a bit like my grandfather used to say, “shutting the stable door after the horse has bolted.”

“shutting the stable door after the horse has bolted.”

What about a third option? We call it Start with Where.

Start by asking where your business depends on that supplier. What service do they provide? Who relies on it? What would your team struggle to do if the supplier couldn’t deliver tomorrow?

Say a supplier processes your customer orders. Once you know that, you can focus on questions that matter to both of you. How quickly would an outage delay orders? Could your team keep taking them? How would the supplier let you know there was a problem? The answers help you decide what needs attention, agree on who will take action and follow up to see whether it’s been done.

That understanding also helps with the options we started with. You can shorten the assessment by asking the supplier only for information and evidence relevant to the service they provide. At contract renewal, you can ask for a specific commitment, such as when the supplier will notify you of an outage. That gives both parties something clearer to discuss and can reduce the pushback that generic clauses often attract. And when an external alert comes in, you already know which part of your business could be affected and who needs to know.

Once you know where your business depends on a supplier, you can focus on what it would take to keep things running if that supplier couldn’t deliver.

At this point, people often ask me, “I can see the value, but how much time will this take my team?”

You can start with one supplier your business relies on and one service they provide. Bring in the person who relies on that service day to day. They can tell you what would happen if it stopped, what they could manage themselves and where they’d need the supplier’s help. That gives you a focused first conversation and keeps the work manageable for both teams.

It’s why we developed the Start with Where approach and built VenDefend to support it.

Let’s start with one of your suppliers so you can see how it works.