The TPRM Top 10 - Incorrect or Incomplete Risk Tiering Is Directing Attention to the Wrong Places

Incorrect or incomplete tiering makes it harder to identify which vendors pose the greatest exposure, spreading scarce resources too thin.

Why it Matters

Risk tiering is the mechanism that turns a large vendor inventory into a manageable set of priorities. It determines which vendors require deeper evidence, stronger contractual protections, and closer monitoring.

The organization’s tiering model may be correct, but a polished tiering model cannot compensate for unreliable or incomplete inputs. If vendors are placed into incorrect tiers (or not placed in a tier at all), every decision that follows can also be wrong. Lower risk relationships can absorb disproportionate attention while vendors tied to critical operations or sensitive data receive too little scrutiny.

"We probably have tens of thousands of vendors and all we've risk rated since I've been here has been like 4,000." -- TPRM Leader commenting on their risk tiering abilities

Risk tiers depend on accurate vendor data. Organizations may be making prioritization decisions from an unreliable foundation without receiving the necessary responses and evidence from their vendors.

What the Evidence Shows

• New 3^rd party research coming soon from HITRUST and CHIME* surveyed over 100 qualified TPRM leaders and found that difficulty obtaining vendor information ranked as the second most important challenge in the CHIME survey, with risk confidence following close after.
  

•  The KPMG 2026 Global Third-Party Risk Management survey identified that only 15% of TPRM leaders had high confidence in the data that underpins their program, and only 18% were fully integrated with Enterprise Risk Management (ERM).

What TPRM Leaders Can Do

• Define tiering criteria around the business impact of vendor failure, the sensitivity of data involved, system access, operational dependency, and downstream reliance.
• Align assurance requirements with each tier instead of applying the same questionnaire or review depth to every vendor.
• Revisit a vendor’s tier when its service scope, data access, dependencies, or operational role changes.
• Document and make visible exceptions and overrides so business pressure does not quietly weaken the tiering model.
• A defensible TPRM program directs the strongest evidence and most experienced judgment toward the relationships that can create the most consequential loss.

Coming Up in the Next Blog in the Series

*CHIME Digital Health Analytics. Third-Party Risk Management Assurance: Strategic Market Validation Survey. Commissioned by HITRUST. Ann Arbor, MI: College of Healthcare Information Management Executives, Digital Health Analytics 2026. In July 2026, HITRUST commissioned CHIME Digital Health Analytics to conduct a blinded market-validation survey of 102 qualified respondents from separate healthcare provider organizations with more than $1 billion in annual revenue. Respondents represented security and GRC leadership, TPRM ownership, procurement and vendor management, legal and contracting, and executive leadership. Every participating organization actively managed at least 200 third-party vendors, and 87% managed more than 500.