Vendor risk management is the process a firm uses to choose, contract with and keep watch over its suppliers, such as software providers, cloud hosts, payment processors and outsourced call centres, so that a supplier's failure, data breach or misconduct does not harm the firm or its customers. It is a large part of managing third-party risk, which is where the full explanation sits.
The usual steps are due diligence before signing, contracts that give audit and exit rights, ongoing monitoring and a plan for replacing a vendor that fails. Regulators treat it as part of operational risk: US banking agencies issued joint guidance on third-party relationships in 2023, and the EU's Digital Operational Resilience Act sets rules for financial firms' technology suppliers. Relying on one supplier for a critical service also creates concentration risk.