Inherent risk is the risk a vendor relationship carries before any of the vendor's controls are considered. A practical way to rate it is to combine two axes: the vendor's tier, which measures the impact if the vendor fails, and its exposure, which measures how likely harm is given the data, access and regulatory reach involved.
Many programs treat the tier and inherent risk as one number. Keeping them apart makes both more accurate. This post explains how exposure is measured, shows a default matrix, works through an example and covers the most common mistakes.
Why are tier and exposure separate axes?
The tier answers an impact question: if this vendor stopped delivering or was compromised, how badly would customers, operations, finances or regulatory standing suffer, and how hard would it be to replace? We cover tiers in detail in what vendor tiering is and how the four tiers work.
Exposure answers a likelihood question: given what this vendor can see and reach, how many paths are there to harm? Privileged production access and large volumes of regulated data offer far more ways for something to go wrong than a monthly spreadsheet of public data.
The two vary independently. A market data feed can be impossible to run without (high impact) while holding no personal data at all (low exposure). A marketing tool can hold a large customer list (high exposure) while being easy to replace (lower impact). Rating inherent risk on both axes stops either one from hiding the other. NIST describes inherent risk as the risk to an entity before management takes any direct action to change its severity (NIST CSRC glossary), and both axes describe that untreated starting position.
How is vendor exposure measured?
Exposure is usually rated High, Medium or Low from three groups of factors captured at intake:
- Data: the types of data the vendor stores, processes or can view (customer personal data, cardholder data, protected health information, credentials, confidential business data) and the approximate volume.
- Access: none, read-only, standard or privileged access, and whether it reaches production systems or networks.
- Regulatory reach: whether the vendor performs or supports a regulated activity, acts toward your customers on your behalf, or brings data protection obligations with it.
A simple rule set is often enough. As an illustrative example only: High exposure where the vendor combines regulated data with privileged access to production; Medium where it holds regulated data or has standard, scoped access, but not privileged access to both; Low where it holds no sensitive data and has no system access. Each program should calibrate its own rules and record them in its methodology.
What does a tier-to-inherent-risk matrix look like?
Once you have the tier and the exposure, a matrix reads off the inherent risk rating. The cells below are a common default. They are a policy choice, so the matrix should be configurable rather than fixed in a tool.
| Criticality \ Exposure | Low | Medium | High |
|---|---|---|---|
| Tier 1 Critical | High | Critical | Critical |
| Tier 2 High | Medium | High | High |
| Tier 3 Medium | Low | Medium | High |
| Tier 4 Low | Low | Low | Medium |
Notice the shape. A Tier 1 vendor never rates below High, because a critical dependency is serious even when exposure is modest. A Tier 4 vendor rarely rises above Low, but High exposure still lifts it to Medium, so a cheap tool with a privileged connection does not slip through.
Worked example: a payroll processor
Take a payroll processor that holds regulated personal data about every employee and has API access to production HR data. The business owner says an outage of 48 hours would be painful but survivable, and that another provider could take over within a quarter.
- Tier: Tier 2 High (sensitive data and access, but not a critical activity, and replaceable).
- Exposure: Medium in this program's illustrative rules (regulated data, but API access scoped to one data set rather than privileged access).
- Inherent risk: High.
Now change one answer. The business owner says that losing payroll for 48 hours would be business-stopping, perhaps because a missed pay run would breach labor obligations across several jurisdictions. That answer is a knockout: it sets a floor of Tier 1. With the same Medium exposure, inherent risk becomes Critical, and the vendor now needs resilience testing and an exit plan as well as a deep security review.
Which rules sit on top of the matrix?
A matrix is only as good as its inputs. Four rules keep it honest:
- Floors. Certain answers set a minimum tier rather than adding to a score. For example, business-stopping if unavailable sets Tier 1, and regulated data or privileged production access sets at least Tier 2. The final tier is the higher of the scored tier and the floor.
- Overrides with justification. An analyst can change the calculated result, but must record why. Keep both the calculated and the final rating so an auditor can re-perform the decision.
- Concentration escalation. If a vendor depends on a provider that many of your critical vendors share, the tier can be raised to reflect that systemic dependency. Concentration should only ever raise a rating. Mapping shared providers is the job of fourth-party and concentration analysis.
- Unreviewed vendors are treated as critical. A vendor with no completed criticality review should be handled as Critical until someone reviews it. A conservative default removes any incentive to skip the questionnaire.
What happens after inherent risk is set?
Inherent risk sizes the assessment: Critical and High ratings call for the full evidence set, Medium and Low for a focused or streamlined review. It also tells reviewers where to look. High exposure points to access, data protection and incident response controls; a high tier points to resilience, financial health and exit planning.
The assessment then produces residual risk: what remains once the vendor's controls have been tested on evidence and findings have been treated. Residual risk should never be higher than inherent risk. We cover that step in inherent risk vs residual risk.
This is the model VendRisk360 uses. In the VendRisk360 vendor lifecycle, a criticality questionnaire sets the tier from Tier 1 Critical to Tier 4 Low, and inherent risk combines that tier with the vendor's exposure. Intake also captures the business case and the data types in scope, and those answers decide which control domains apply and how deep the review goes.
What mistakes distort inherent risk?
Three errors show up in almost every program review.
- Tiering by spend. Contract value is a poor proxy for impact or exposure. A free tool with an API connection to production can carry more inherent risk than a large consulting contract.
- Letting a strong external security rating lower the tier. An outside-in grade tells you something about how well a vendor manages its internet-facing systems. It does not change how much you depend on the vendor or what it can access. Use the rating as monitoring evidence that feeds residual risk, and leave the tier and exposure alone.
- Never re-tiering. Vendors add services, gain access and get acquired. A rating set at onboarding and never revisited drifts away from reality. Reopen the tier and exposure whenever the scope, data, access, ownership or regulatory status changes, and confirm them at every reassessment.
Frequently asked questions
Is vendor tier the same as inherent risk?
No. The tier measures impact: how much harm a failure would cause and how hard the vendor would be to replace. Inherent risk combines that impact with exposure, the likelihood side driven by the vendor's data, access and regulatory reach. Two vendors in the same tier can carry different inherent risk because one has far more access or holds far more sensitive data.
How do you calculate a vendor's inherent risk?
Set the tier from a criticality questionnaire, rate exposure as High, Medium or Low from data, access and regulatory factors, then read the inherent risk rating from a matrix that combines the two. Apply floors for knockout answers, record any analyst override with its justification, and treat a vendor with no completed review as Critical until it is reviewed.
Should a good security rating lower a vendor's inherent risk?
No. An outside-in security rating describes how a vendor's internet-facing systems look today. It does not change the vendor's access, the data it holds or how much you depend on it, which is what inherent risk measures. Use the rating as monitoring evidence when you judge residual risk, alongside the controls you have tested on evidence.
Should the inherent risk matrix be the same for every organization?
No. The matrix encodes risk appetite, so each organization should set and document its own cells. A heavily regulated bank may rate more combinations as Critical than a software company does. What matters is that the matrix is written into policy, applied consistently and reviewed when appetite or regulation changes.
About VendRisk360
VendRisk360 is an AI-assisted third-party risk management (TPRM) SaaS platform for regulated organizations. It keeps one governed record per vendor from intake to exit, assesses each vendor on evidence scaled to its risk tier, monitors vendors continuously from the outside (attack surface, data breaches, financial distress and adverse news), maps fourth and nth parties, and produces board-ready reporting. Teams run their program on the platform themselves, or turn on managed assessments and monitoring, delivered on the platform by VendRisk360’s certified reviewers. People make every decision.
This post is general guidance, not legal advice. Confirm your obligations with counsel and your supervisors.
