Vendor Risk
Vendor risk evidence is retained for SOC 2 audit support, customer assurance, management review, and ongoing monitoring.
Use this guide to put the control into operation, decide what records to retain, and check that an auditor can trace the evidence back to the work your team performed.
Maintained by GreenHat Security · Reviewed August 21, 2026
Vendor decisions remain understandable and defensible because the company preserves the inventory record, classification, review material, findings, approvals, contracts, monitoring, incidents, access reviews, and offboarding evidence for the period each vendor was used.
First SOC 2 program
Create one restricted folder and index per vendor, store dated copies rather than changeable links, and use a consistent naming convention for onboarding, annual review, decisions, agreements, incidents, and termination. Test whether someone other than the owner can retrieve a complete vendor history.
As the company scales
Use a vendor-risk repository with required metadata, version history, role-based access, automated evidence capture, retention and legal-hold rules, completeness dashboards, and periodic retrieval checks across a sampled vendor population.
Identify records for inventory, ownership, classification, due diligence, findings, approval, contract terms, access, reassessment, incidents, exceptions, communications, and offboarding.
You should end up with: An evidence inventory that maps each vendor-risk activity to an authoritative source and owner.
Determine retention periods from applicable legal, contractual, business, customer-assurance, and review needs, and restrict access based on vendor, customer, security, and personal-data sensitivity.
You should end up with: Approved retention, disposal, access, and hold rules for vendor-risk records.
Organize records by a consistent vendor identifier and capture record type, vendor tier, service, owner, review date, applicable period, decision, version, and expiration.
You should end up with: A searchable index that connects records across the vendor lifecycle.
Store dated copies or controlled exports with approvals, source, period, scope, reviewer, and decision context rather than relying on live links or current system state.
You should end up with: Versioned evidence that shows what information management relied on at the time of each decision.
Assign people or automated jobs to retain records when onboarding, approval, reassessment, access review, incident, exception, contract change, and offboarding events occur.
You should end up with: A continuously maintained vendor file with event dates and no unexplained lifecycle gaps.
Periodically select vendors across tiers and lifecycle stages, reconcile expected records, retrieve them through approved access, and remediate missing, expired, or unreadable evidence.
You should end up with: A dated retrieval and completeness review with findings and completed corrections.
Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.
Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
Confirm what the record proves
Periodic checks verified that selected vendor files contain the expected classification, assurance, findings, approval, contract, monitoring, access, incident, and exit records.
Include this context
review date and reviewer
Include this context
vendor sample or population
Include this context
expected evidence by lifecycle stage
Include this context
retrieval and completeness result
Include this context
finding and owner
Include this context
correction and closure date
Weak evidence to avoid
A statement that vendor evidence is complete without the vendors sampled, expected artifact list, retrieval result, missing records, owners, or corrections.
Confirm what the record proves
Approval, conditional use, exception, continued use, suspension, rejection, and termination decisions remain connected to the facts, findings, authority, and date on which they were made.
Include this context
vendor and decision identifier
Include this context
decision type and date
Include this context
decision authority
Include this context
evidence and findings considered
Include this context
residual risk and conditions
Include this context
effective and review dates
Weak evidence to avoid
A current vendor status of approved with no historical decision, approving authority, evidence considered, conditions, residual risk, or effective date.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
Confirm what the record proves
Vendor lifecycle evidence is centrally indexed, access-controlled, versioned, and retrievable from onboarding through monitoring, incidents, decisions, and termination.
Include this context
vendor identifier
Include this context
record type and source
Include this context
applicable review period
Include this context
event date and version
Include this context
owner or reviewer
Include this context
stored record link or checksum
Weak evidence to avoid
A shared folder with vendor names but no index, lifecycle categories, dates, versions, access restrictions, or way to determine which records supported a decision.
Confirm what the record proves
Vendor records follow configured retention, disposal, access, versioning, and hold rules, and retained files remain readable for the intended period.
Include this context
record class and repository
Include this context
retention trigger and duration
Include this context
configured disposition
Include this context
access roles
Include this context
version or hold state
Include this context
configuration or retrieval test date
Weak evidence to avoid
A written retention period with no repository configuration, record-class mapping, disposition log, version protection, access role, or retrieval result.
Type 1
Current repository structure and access settings, approved vendor-record retention rules, the current vendor evidence index, and the latest completeness and retrieval review as of the examination date.
Type 2
Every vendor-risk record created, revised, archived, disposed, placed on hold, migrated, or selected for completeness testing during the review period across all active and terminated vendor lifecycle stages.
Reconcile evidence indexes to vendor lifecycle events in intake, review, contract, access, incident, and offboarding systems, then retest missing or unreadable records and verify disposition logs against configured retention rules.
Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.
Determine whether the control is designed to achieve this result: Vendor decisions remain understandable and defensible because the company preserves the inventory record, classification, review material, findings, approvals, contracts, monitoring, incidents, access reviews, and offboarding evidence for the period each vendor was used.
Compare the documented owner with the intended role (Vendor Risk Owner / CISO / Legal), then compare dated records with the stated cadence: Prior to onboarding; periodic based on risk; at least annually for critical/high.
Reconcile evidence indexes to vendor lifecycle events in intake, review, contract, access, incident, and offboarding systems, then retest missing or unreadable records and verify disposition logs against configured retention rules.
Current repository structure and access settings, approved vendor-record retention rules, the current vendor evidence index, and the latest completeness and retrieval review as of the examination date.
Every vendor-risk record created, revised, archived, disposed, placed on hold, migrated, or selected for completeness testing during the review period across all active and terminated vendor lifecycle stages.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
For each selected record, confirm it demonstrates Periodic checks verified that selected vendor files contain the expected classification, assurance, findings, approval, contract, monitoring, access, incident, and exit records.
For each selected record, confirm it demonstrates Approval, conditional use, exception, continued use, suspension, rejection, and termination decisions remain connected to the facts, findings, authority, and date on which they were made.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
For each selected record, confirm it demonstrates Vendor lifecycle evidence is centrally indexed, access-controlled, versioned, and retrievable from onboarding through monitoring, incidents, decisions, and termination.
For each selected record, confirm it demonstrates Vendor records follow configured retention, disposal, access, versioning, and hold rules, and retained files remain readable for the intended period.
Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.
These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.
Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.