The Vendor Questionnaire Isn't the Evidence. The Person Who Reviewed It Is.
November 12, 2026
Ric Hall, CRO— AI-assisted and reviewed prior to publication.
A completed vendor security questionnaire tells an examiner almost nothing on its own. What it actually wants to know is who reviewed the answers, whether that person had the training to catch a weak response, and whether the organization can document that review. A vendor file full of SOC 2 reports with no named, qualified reviewer behind them is a program waiting to fail its next audit.
Why do bank examiners care who filled out the vendor file, not just what's in it?
Examiners care about the reviewer because a questionnaire is only as good as the judgment applied to it, and regulators have started writing that expectation directly into guidance. The Federal Reserve's third-party risk guide for community banks tells examiners to check the bank's human resources function to confirm that management and staff have the expertise and capacity to manage the relationship before a vendor relationship is even approved. That is a staffing check, not a paperwork check.
The FFIEC IT Examination Handbook makes the same point even more directly. Its section on third-party management states that the oversight of the relationship should be performed by staff with knowledge of the services provided, and ties the rigor of that oversight to the criticality of the outsourced process. A junior analyst rubber-stamping a cloud vendor's SOC 2 report because the report exists, without understanding what the report actually attests to, does not satisfy that bar.
The 2023 interagency guidance from the Fed, OCC, and FDIC goes further across the entire third-party relationship lifecycle. It directs institutions to involve staff with the requisite knowledge and skills in each stage of the risk-management life cycle, from planning through termination, which means the same qualifications question applies at onboarding, at the annual reassessment, and at offboarding, not just at the start.
What does SOC 2 actually require from the people doing the vendor review, not just the policy?
SOC 2's Trust Services Criteria require the organization to identify, assess, and manage risk from vendors and business partners as an ongoing control, not a one-time gate. Under Common Criteria CC9.2, auditors expect documented procedures for onboarding new vendors and partners, conducting ongoing due diligence, and regularly reviewing the security practices of third-party service providers. A policy that describes this process in the abstract, with no evidence of who actually performed the review or what they flagged, is the kind of gap that shows up in a Type II report's exceptions section.
This is also where the AI question has started landing on vendor files. Auditors are now folding AI system risk into the same risk assessment, access control, and vendor management criteria that already exist rather than waiting for a separate AI-specific control, which means the person reviewing a vendor's SOC 2 report now needs enough fluency in how that vendor uses machine learning models or third-party APIs to ask the right follow-up questions. That is a skills gap for most vendor-risk teams, not a tooling gap.
New York made the staffing question explicit for financial services
New York's cybersecurity regulation does not leave the qualification question implicit. Section 500.11 requires covered entities to implement written policies and procedures based on a risk assessment that address identification and risk assessment of third-party service providers, minimum cybersecurity practices, due diligence, and periodic reassessment. The regulation does not just ask for a policy to exist. It asks the covered entity to demonstrate the risk assessment underneath it, which only a qualified reviewer can produce defensibly.
The practical effect shows up during an exam. A DFS examiner asking to see the due diligence file for a critical vendor is also implicitly asking who built that file, because a risk assessment with no named owner and no documented rationale reads as a compliance exercise rather than an actual risk judgment. That distinction matters more now that the amended regulation ties third-party oversight to an annually refreshed, enterprise-wide risk assessment rather than a static vendor list.
The accountability gap most vendor-risk programs actually have
Most organizations have a vendor inventory. Most have a questionnaire template, and most have a shared drive full of SOC 2 reports and ISO 27001 certificates collected during onboarding. What they often lack is a documented answer to a simple question: who on staff is qualified to read a SOC 2 Type II report, spot a qualified opinion or a carved-out subservice organization, and translate that into a risk rating the business can act on.
That gap is exactly what shows up as a finding, whether the reviewer is a bank examiner working from the FFIEC handbook, a SOC 2 auditor testing CC9.2, or a DFS examiner pulling a 500.11 due diligence file. The fix is not a better questionnaire. It is a named, trained reviewer whose qualifications are documented alongside the vendor file itself, so the evidence trail runs from the certification on file back to the person who evaluated it.
| Framework | What it expects from the reviewer | Where it shows up |
|---|---|---|
| FFIEC IT Handbook | Staff with knowledge of the services provided, scaled to criticality | Third-Party Management section |
| Fed / OCC / FDIC interagency guidance | Requisite knowledge and skills at every stage of the relationship lifecycle | 2023 interagency guidance |
| SOC 2 | Documented due diligence and ongoing review under CC9.2 | Type II report exceptions |
| NYDFS 23 NYCRR 500.11 | Risk assessment behind the policy, not just the policy itself | Annual DFS certification |
Building a vendor-risk reviewer who can actually clear these bars
A credential will not replace judgment, but it does give an organization a defensible, third-party-verified answer to the staffing question examiners and auditors keep asking. ISACA's CRISC exam content outline puts Vendor/Supply Chain Risk Management directly inside its risk response and reporting domain, which covers roughly a third of the exam, meaning a certified practitioner has been tested specifically on assessing vendor posture, scoring risk against organizational criteria, and producing findings that support a treatment decision rather than just a checklist.
That domain coverage lines up with how risk teams actually get staffed. Job postings for third-party risk analysts and GRC leads routinely list CRISC alongside CISA and CISSP as the expected credential for the role, which tells you how hiring managers and, by extension, examiners are already reading the credential as evidence of qualification. If your vendor-risk team cannot point to a staff member with that kind of documented training, the next exam or audit cycle is the wrong time to discover it.
Building that bench does not require retraining an entire GRC function at once. Start with the people who already own the highest-criticality vendor relationships, since that is where an examiner's sampling is most likely to land first. Forge University's CRISC certification prep covers the vendor and supply chain risk material directly, and the curriculum resources page breaks down how the domain weighting maps to day-to-day vendor review work if you want to see the fit before committing a training budget. If you want a study plan built around this, you can start training whenever you is ready.
What to document now, before an examiner asks
Two things close most of this gap quickly. First, attach a named reviewer and their qualifications to every vendor file, not just a department name, so the evidence trail survives a staffing change. Second, revisit that assignment on the same cadence as your risk assessment refresh, since a reviewer who was qualified two years ago may not be current on how a vendor's AI usage or subservice organizations have changed since then.
Neither of those steps requires new software. They require a decision about who on your team is actually positioned to make a defensible risk call on a vendor's security posture, and a record showing that decision was made deliberately rather than inherited from whoever happened to own the vendor relationship last quarter. That is the evidence an examiner is actually looking for when they ask to see the file.