The questionnaire arrived in the inbox on a Monday. Two hundred questions covering information security, business continuity, data protection, subcontracting, financial stability, and workforce management. By Friday the vendor’s compliance team responded with two hundred green ticks. Their covering letter mentioned their ISO certifications. That is the moment most third party risk assessment processes quietly stop being risk assessments and start being paperwork exchanges. The buyer files the response. The vendor moves on. Nobody has learned anything meaningful about whether the vendor can actually do what the contract will eventually ask of them.

The gap between what questionnaires measure and what regulators actually want is where the real risk lives. It is where UK financial services firms increasingly get caught when a supervisor asks how they signed off on a particular vendor. This is why serious buyers and every credible BPO financial services partner treat the assessment as an operational discipline rather than a document exchange. The paperwork version leaves the buyer exposed on exactly the dimensions that matter most under UK regulatory scrutiny. This piece walks through why standard questionnaires fail. It covers what a working assessment actually tests. And it lays out how to rebuild the process without doubling the compliance burden on either side.

Why Most Vendor Risk Reviews Never Get Read

The read failure is structural. A standard due diligence questionnaire arrives with two hundred questions. Most have a single acceptable answer. The vendor knows what that answer is. The buyer knows what that answer is. Both parties fill in the form with the expected answer. The resulting document sits in a compliance folder as evidence that the process happened. Nobody reads it in detail because there is nothing to learn from reading it. The questionnaire measures whether the vendor knows what to say. Not whether they can actually do the work.

The regulator has been clear about this failure mode. The Prudential Regulation Authority’s supervisory statement on outsourcing and third party risk management requires firms to perform appropriate and proportionate due diligence. That has to cover the potential provider’s business model, financial situation, human and technology resources, and any sub-outsourced service providers involved in delivering important business services. That specification is not compatible with a tick-box questionnaire. It requires judgement calls, follow-up questions, and a willingness to look past presented answers to the operational reality underneath.

The result is a widespread pattern that firms recognise privately but rarely address openly. The formal third party risk assessment happens because it is required. The actual risk assessment happens informally. In conversations with the sponsor. In references from other buyers. In whatever the account team says off the record about how the vendor really operates. Neither of those informal assessments makes it into the compliance file. When the supervisor asks how a decision was made, the file shows only the questionnaire the paperwork required.

What a Real Vendor Risk Review Should Actually Test?

A real assessment tests capability rather than documentation. The distinction is important. A vendor can hold every certification, publish every policy, and complete every questionnaire perfectly. And still run an operation that would fail a serious stress test. Capability is what the vendor can do when a problem lands unexpectedly. Documentation is what the vendor can produce when a questionnaire lands predictably. The two overlap sometimes and diverge often. The assessment has to test the first, not just verify the second.

The specific dimensions worth testing on a serious third party risk assessment cluster into four categories. Financial resilience under stress. What happens to the vendor’s service if one of their large clients leaves suddenly, or if their own funding tightens? Operational resilience under load. What actually happens when contact volume spikes or when a key supervisor is out for a fortnight? Sub-outsourcing transparency. Can the buyer trace every leg of the service back to the actual party performing the work? And regulatory readiness. Could the vendor produce the specific evidence a UK supervisor would ask for during a section 166 review?

Testing these dimensions requires a different assessment design. Structured reference calls with existing clients who use the vendor at similar scale. Site visits or virtual walk-throughs of the actual operation floor. Not the sales tour. Requests for evidence of past incident handling, with names and dates removed. And test cases the vendor has to respond to in real time. On a phone call with the buyer’s operations team on the line. That way the assessment tests how the vendor actually thinks, not how their compliance team writes.

How Third Party Risk Assessment Questionnaires Miss the Mark

Standard questionnaires miss on three specific dimensions that most buyers do not realise until something goes wrong in production. The first is subcontracting transparency. A vendor may hold up their own operational standards while delegating parts of the service to sub-vendors whose standards are lower. The questionnaire asks about sub-outsourcing at a headline level. The answer often understates the sub-contracting exposure. The buyer discovers the actual arrangement only when a service issue traces back to a sub-vendor they had never approved.

The second miss is scenario realism. Business continuity questions typically ask whether the vendor has a plan, tests it, and can invoke it. Almost every vendor answers yes to all three. What the questionnaire does not test is a partial failure the plan did not fully anticipate. That is where most real incidents actually land. The vendor’s plan may exist. The plan may be tested. And the plan may still fail when the specific failure mode falls outside the tested scenarios. This ties into how consistency in regulated service environments demands infrastructure rather than exhortation. The documented plan and the operational reality often diverge in exactly the moments when they most need to align.

The third miss is workforce and cultural signal. Questionnaires rarely capture attrition trends, coaching cadence, or the internal culture. Those are what decide how the vendor’s frontline actually behaves under pressure. Those signals determine whether the service holds up in month twelve of the contract. They are almost impossible to detect through a document exchange. The vendor’s presentation is designed for buyers. The vendor’s floor is designed for their own operations, and the two can be very different places. A buyer who never visits the floor and never speaks to the frontline is signing off on a vendor they have only met through their sales function.

What Regulators Want From Your Third Party Risk Assessment Now

UK regulators have been increasingly specific about what they expect. Under the FCA and PRA framework governing outsourcing and third party risk, firms have to determine the materiality of every arrangement. They have to perform appropriate and proportionate due diligence. They have to assess the risks of all arrangements regardless of materiality. And they have to document the whole process in a way that would allow a supervisor to reconstruct the decision months or years later. That last requirement is the one most firms underestimate.

The FCA framework for managing outsourcing and third-party risk reinforces the same principle. The specific documentation regulators expect goes beyond the completed questionnaire. It includes the methodology used to determine materiality, the specific risks identified during the assessment, the mitigations agreed with the vendor, the ongoing monitoring plan, and the escalation triggers that would prompt a formal review. Firms that only file the questionnaire response are systematically underdocumented against this standard. The gap surfaces during a supervisory visit in a way that is difficult to explain retrospectively. This ties into how support documentation standards determine whether a decision can be reconstructed months later. The reconstruction principle applies to vendor decisions as much as to customer interactions.

The retention side also matters. Records tied to third party risk assessment work should be kept for the period the regulator would expect. That typically runs several years past the end of the arrangement. A third party risk assessment that was signed off on a thin file three years ago becomes a supervisory finding today when the operation goes wrong and the file cannot support the original decision. The cost of the missing documentation is not the compliance file. It is the enforcement consequence that follows.

How to Rebuild Your Third Party Risk Assessment This Quarter

The rebuild works best when it starts from the questions the supervisor would actually ask, not from the standard questionnaire template. Sit down with the sponsor and the risk function. Write out the specific concerns the buyer holds about the vendor. Concentration risk. Sub-outsourcing exposure. Financial dependency. Cultural fit. Regulatory readiness. That list is the design brief for the assessment. Every element of the process should trace back to at least one of the concerns. Where the standard questionnaire covers a concern well, keep those questions. Where it does not, add the specific enquiry the buyer actually needs answered.

The second step is to redesign the evidence expectations. Instead of accepting policy documents, request evidence that the policies operate in practice. Instead of accepting business continuity plans, request evidence of the last full test. Request the specific gaps it surfaced. Instead of accepting attrition rate statements, request twelve months of trend data. Also request a description of the underlying drivers. Vendors who cannot produce this evidence are signalling something important about how the actual operation runs. That signal is worth as much as any answered question. This ties into how training strategies for service teams need to reflect the specific gaps in day-to-day work. Evidence of a working training programme is what a serious assessment should require. Not the existence of a training policy.

The third step is to build the ongoing monitoring plan into the assessment itself, rather than treating it as a separate workstream that starts after signature. Define the specific signals the buyer will track quarterly. Define the thresholds that would trigger escalation. And define the review cadence that will keep the assessment current as the vendor’s operation evolves. A third party risk assessment that is refreshed once every three years is not a real assessment. It is a snapshot that quietly ages out of validity while the vendor’s underlying operation changes shape. Building the monitoring in at design time is what turns a compliance artefact into a live management tool. That is the version worth building. It separates buyers who navigate regulatory scrutiny well from those who do not.

Frequently Asked Questions About Third Party Risk Assessment

James Whitmore

Offshore BPO analyst covering the UK, South Africa, and the Philippines. Writing on outsourcing strategy, compliance, and CX operations across all three markets — from British buyers to offshore operators.