Definition

Vendor risk management (VRM)

Vendor risk management is the practice of identifying, assessing, and mitigating the risks a third-party vendor introduces to an organisation.

VRM spans security, compliance, financial stability, and operational dependency. The most overlooked dimension is concentration risk — how hard and expensive it would be to replace the vendor if they failed, raised prices, or were acquired.