Spreadsheets, questionnaires, and disconnected tools consume capacity that should be spent evaluating and reducing risk.

Why It Matters

Many TPRM programs still depend on fragmented workflows. Teams track vendors in spreadsheets, distribute proprietary questionnaires, collect documents through email, and reconcile evidence manually. Each handoff adds time without necessarily improving the quality of the final decision.

HITRUST conversations with TPRM leaders reflect the issue. One TPRM leader described their process as tracking vendors in a Google Sheet, distributing questionnaires, and separately collecting security documentation. They only began the assessment once all those materials had been returned.

The problem is larger than the absence of a workflow platform. Digitizing the same questionnaire and document chase can preserve the underlying inefficiency. Programs need consistent assessment methods, reusable evidence, and automation that removes administrative work from trained analysts.

What the Evidence Shows

New 3^rd party research coming soon from HITRUST and CHIME* surveyed over 100 qualified TPRM leaders and found that:

• The most selected improvement in the CHIME survey was “Reduce time and/or manual effort”, chosen by 38.2% of respondents.
  
• “Efficiency/Scale” was identified as the highest ranked challenge facing TPRM programs 
• According to the Mitratech 2025 Third-Party Risk Management Study, 41% of respondents still used spreadsheets as their primary TPRM tool.

What TPRM Leaders Can Do

• Use tools to centrally manage vendor evidence, records and monitoring so reviewers do not reconstruct the vendor record for each decision.
• Automate routine evidence collection, control mapping, reminders, and reassessment triggers.
• Use AI-assisted review where it can accelerate interpretation, while keeping human judgment focused on scope, exceptions, and material risk.
• Automation should change where people spend their time. The measure of progress is whether analysts have more capacity to evaluate risk and support timely decision

Coming Up in the Next Blog in the Series

*CHIME Digital Health Analytics. Third-Party Risk Management Assurance: Strategic Market Validation Survey. Commissioned by HITRUST. Ann Arbor, MI: College of Healthcare Information Management Executives, Digital Health Analytics 2026. In July 2026, HITRUST commissioned CHIME Digital Health Analytics to conduct a blinded market-validation survey of 102 qualified respondents from separate healthcare provider organizations with more than $1 billion in annual revenue. Respondents represented security and GRC leadership, TPRM ownership, procurement and vendor management, legal and contracting, and executive leadership. Every participating organization actively managed at least 200 third-party vendors, and 87% managed more than 500.

Inconsistent scoring and reporting methods make it difficult to compare assurance reports and results across vendors. 

Why It Matters

TPRM teams receive multiple forms of evidence to evaluate: Questionnaires, SOC 2 reports, HITRUST certification reports, penetration test results, vulnerability scans, and much more. Each artifact answers different questions and may use a different scope, testing method, treatment of exceptions, and reporting format. Reviewers must normalize the evidence before they can compare vendors or explain why one finding matters more than another.

That work depends heavily on analyst experience and repeated interpretation. Two vendors can appear to provide similar assurance while covering different systems or controls. The same weakness can be described in different terms or reported at a different level of detail. Comparison becomes a manual judgment exercise rather than a repeatable program capability.

What the Evidence Shows

New 3^rd party research coming soon from HITRUST and CHIME* surveyed over 100 qualified TPRM leaders and found that:

• Standardized requirements accepted across the organization and independent third-party assurance were the two most-valued attributes in the future-state model.
  
• 92% of respondents estimated that relying on a single validated certification could save at least eight hours per vendor assessment. An organization assessing 100 vendors per year could save 800 hours, or 100 business days, by utilizing this strategy.
  

What TPRM Leaders Can Do

• Define a consistent baseline for scope, control coverage, testing, and exception reporting across assurance mechanisms.
• Use common criteria to evaluate the relevance and severity of findings, regardless of the format in which they arrive.
• Increase reliance on standardized, independently validated evidence that can be reused across vendor relationships.
• Reserve supplemental requests for material gaps in coverage instead of repeating evidence already validated.

Requiring a single standardized certification can provide tremendous benefit to TPRM programs, both in reducing risk and increasing efficiency. Standardized independent validation can provide a more comparable baseline across a TPRM program’s vendors. When moving to adopt a standardized assurance model, the CHIME survey reported mixed results with how TPRM leaders would approach the process. Most programs (41%) would roll it out to high-risk vendors immediately and then expand to other vendors over the next year, while others (32%) would prefer to pilot first with a smaller group of those critical vendors.

The goal is not to conduct the same exhaustive assessment for every vendor, but to produce enough trustworthy information to identify material exposures early and direct limited expertise toward the risks capable of causing the greatest business impact.

Coming Up in the Next Blog in the Series

*CHIME Digital Health Analytics. Third-Party Risk Management Assurance: Strategic Market Validation Survey. Commissioned by HITRUST. Ann Arbor, MI: College of Healthcare Information Management Executives, Digital Health Analytics 2026. In July 2026, HITRUST commissioned CHIME Digital Health Analytics to conduct a blinded market-validation survey of 102 qualified respondents from separate healthcare provider organizations with more than $1 billion in annual revenue. Respondents represented security and GRC leadership, TPRM ownership, procurement and vendor management, legal and contracting, and executive leadership. Every participating organization actively managed at least 200 third-party vendors, and 87% managed more than 500.

Some vendors are so critical to business functions that organizations have little practical ability to reject or replace them, even when assessments identify material concerns. 

Why It Matters

Some vendors are embedded so deeply in business environments that the organization has few alternatives. Migration costs, delivery deadlines, service dependencies, and a lack of credible replacements weaken the influence of the TPRM program precisely when the potential impact is greatest.

In these cases, approval can become the expected outcome rather than the result of an open risk decision. TPRM teams may be asked to document a path forward even when the available evidence is incomplete or worse, the identified risk exceeds policy. The organization still carries the exposure, but accountability for accepting it may remain unclear.

What the Evidence Shows

New 3^rd party research coming soon from HITRUST and CHIME* surveyed over 100 qualified TPRM leaders and found that:

• Approximately 29% of CHIME survey respondents agreed or strongly agreed that their organizations had approved vendors beyond stated risk tolerance.

• The other CHIME response by TPRM leaders demonstrates the potential impact of these approvals: About 22.6% reported that a vendor incident had caused clinical or operational disruption.

• Creation and executive agreement on a decision rights and accountability model, to be able to assign explicit ownership for any approval beyond stated risk tolerance.

• Document the rationale, material exposure, mitigating controls, and conditions of approval.

• Set time-bound remediation requirements and enhanced monitoring for unresolved risk.

• Test continuity arrangements and define an exit or substitution plan, even when replacement is not immediately practical.

What TPRM Leaders Can Do

Criticality does not reduce vendor risk. It raises the cost of failure and narrows the organization’s options, making transparent governance and accountable risk acceptance more important.

Coming Up in the Next Blog in the Series

*CHIME Digital Health Analytics. Third-Party Risk Management Assurance: Strategic Market Validation Survey. Commissioned by HITRUST. Ann Arbor, MI: College of Healthcare Information Management Executives, Digital Health Analytics 2026. In July 2026, HITRUST commissioned CHIME Digital Health Analytics to conduct a blinded market-validation survey of 102 qualified respondents from separate healthcare provider organizations with more than $1 billion in annual revenue. Respondents represented security and GRC leadership, TPRM ownership, procurement and vendor management, legal and contracting, and executive leadership. Every participating organization actively managed at least 200 third-party vendors, and 87% managed more than 500.