Spreadsheets, questionnaires, and disconnected tools consume capacity that should be spent evaluating and reducing risk.
Why It Matters
Many TPRM programs still depend on fragmented workflows. Teams track vendors in spreadsheets, distribute proprietary questionnaires, collect documents through email, and reconcile evidence manually. Each handoff adds time without necessarily improving the quality of the final decision.
HITRUST conversations with TPRM leaders reflect the issue. One TPRM leader described their process as tracking vendors in a Google Sheet, distributing questionnaires, and separately collecting security documentation. They only began the assessment once all those materials had been returned.
The problem is larger than the absence of a workflow platform. Digitizing the same questionnaire and document chase can preserve the underlying inefficiency. Programs need consistent assessment methods, reusable evidence, and automation that removes administrative work from trained analysts.
What the Evidence Shows
New 3rd party research coming soon from HITRUST and CHIME* surveyed over 100 qualified TPRM leaders and found that:
- The most selected improvement in the CHIME survey was “Reduce time and/or manual effort”, chosen by 38.2% of respondents.
- “Efficiency/Scale” was identified as the highest ranked challenge facing TPRM programs
- According to the Mitratech 2025 Third-Party Risk Management Study, 41% of respondents still used spreadsheets as their primary TPRM tool.
What TPRM Leaders Can Do
- Use tools to centrally manage vendor evidence, records and monitoring so reviewers do not reconstruct the vendor record for each decision.
- Automate routine evidence collection, control mapping, reminders, and reassessment triggers.
- Use AI-assisted review where it can accelerate interpretation, while keeping human judgment focused on scope, exceptions, and material risk.
- Automation should change where people spend their time. The measure of progress is whether analysts have more capacity to evaluate risk and support timely decision
Coming Up in the Next Blog in the Series
If you missed the first blog in the series, please check out it here. Be sure to follow HITRUST on LinkedIn and X to know when the next blog in the TPRM Top 10 series, Hidden Vendor Risks, is posted.
*CHIME Digital Health Analytics. Third-Party Risk Management Assurance: Strategic Market Validation Survey. Commissioned by HITRUST. Ann Arbor, MI: College of Healthcare Information Management Executives, Digital Health Analytics 2026. In July 2026, HITRUST commissioned CHIME Digital Health Analytics to conduct a blinded market-validation survey of 102 qualified respondents from separate healthcare provider organizations with more than $1 billion in annual revenue. Respondents represented security and GRC leadership, TPRM ownership, procurement and vendor management, legal and contracting, and executive leadership. Every participating organization actively managed at least 200 third-party vendors, and 87% managed more than 500.