A vendor risk rating model should document residual risk and ongoing monitoring requirements.

• A. None of the above
• B. Document residual risk and ongoing monitoring requirements
• C. Only initial risk rating, no monitoring
• D. Only financial stability

Answer: (B)

In vendor risk management, you need to capture the remaining risk after safeguards and spell out how you will keep watching the vendor over time. This means documenting residual risk—the level of risk that remains even after controls are applied—and outlining ongoing monitoring requirements, including how often you reassess, what controls or indicators you’ll monitor, and what triggers escalation or action.

This combination matters because risk is dynamic. A vendor’s security posture, controls, and business environment can change, as can the threats and regulatory landscape. By documenting residual risk, you acknowledge what still could go wrong and use that to inform risk acceptance and mitigation plans. By defining ongoing monitoring, you establish a repeatable process to detect changes and respond promptly, rather than relying on a one-time assessment.

Focusing only on an initial risk rating without monitoring would leave you blind to drift in risk posture. Zeroing in on financial stability alone ignores cybersecurity and other non-financial risk facets that can affect vendor risk. Therefore, the best approach is to document residual risk and establish ongoing monitoring requirements.