The TPRM Top 10 - Unreliable Vendor Data Undermines Risk Decisions

Incomplete or unreliable information weakens risk decisions and delays action.

Why it Matters

For vendors already known to the organization, the central challenge is often the quality of the information available. Assurance artifacts may omit critical details, provide vague descriptions, or fail to demonstrate the vendor’s actual security posture. TPRM teams then spend additional time asking questions and requesting evidence that should have been clear at the outset.

“I don’t like wasting time with them back and forth, back and forth, back and forth.” -- TPRM Leader commenting on the challenges with vendor evidence

Poor data can distort onboarding approval decisions, risk tiering, and offboarding resulting in higher risk to the organization. If a relationship is misclassified or its scope is misunderstood, the organization may apply the wrong level of due diligence throughout the vendor lifecycle.

What the Evidence Shows

• New 3^rd party research coming soon from HITRUST and CHIME* surveyed over 100 qualified TPRM leaders and found that “Difficulty getting information” ranked as the second most important challenge.

 TPRM leaders consistently describe to HITRUST their problems receiving assurance artifacts that leave critical questions unanswered regarding scope, inherited controls, fourth-party dependencies, and actual security effectiveness.

What TPRM Leaders Can Do

• Set minimum information requirements for scope, data handling, control coverage, and exceptions.
• Use standardized, independently validated evidence to improve consistency and reduce repeated follow-up.
  
• Treat data quality as a control over the TPRM process because weak inputs can invalidate sound review methods..

TPRM programs do not need more documents for their own sake. They need complete, trustworthy, and decision-ready information that can support consistent risk judgments.

Coming Up in the Next Blog in the Series

If you missed the first blog in the series, please check out it here. Be sure to follow HITRUST on LinkedIn and X to know when the next blog in the TPRM Top 10 series, Vendor Risk Is Changing Faster Than Reassessment Cycles, is posted.  

*CHIME Digital Health Analytics. Third-Party Risk Management Assurance: Strategic Market Validation Survey. Commissioned by HITRUST. Ann Arbor, MI: College of Healthcare Information Management Executives, Digital Health Analytics 2026. In July 2026, HITRUST commissioned CHIME Digital Health Analytics to conduct a blinded market-validation survey of 102 qualified respondents from separate healthcare provider organizations with more than $1 billion in annual revenue. Respondents represented security and GRC leadership, TPRM ownership, procurement and vendor management, legal and contracting, and executive leadership. Every participating organization actively managed at least 200 third-party vendors, and 87% managed more than 500.