Vendor risk is where small companies over-build. Auditors do not expect a 30-page assessment of your office-supplies vendor; they expect to see that you know which vendors can reach customer data, that you checked those before trusting them, and that you check again every year. Six artifacts cover it.
The inventory, including the shadow SaaS
One row per vendor with service, data access, system access, tier, assurance held, contract terms and owner. Build it from finance’s payment list, not from memory; the design tool an engineer expensed last spring is on the card statement and nowhere else. The vendor risk playbook has the column list.
Tiering that matches reality
Critical: production access or customer personal data (cloud provider, database vendor, payment processor). High: sensitive business data or operational dependency (identity provider, source control, HR system). Medium and Low: the rest. For a company this size the Critical and High list is usually eight to fifteen names; that is the list you assess.
Assess with their report, not your questionnaire
Every Critical vendor at that size publishes a SOC 2 or ISO 27001 report. Read it for the five things that matter: type and period, criteria in scope, opinion, exceptions in controls you depend on, and the complementary user entity controls, which are the things the vendor assumes you do. Record the review in a one-page log. Send your own questionnaire only to vendors without a report.
Your own code supply chain counts
Source control is a High vendor and also a control surface of your own. The GitHub spot check reads branch protection, required reviews, Dependabot, secret scanning and 2FA from a read-only token in a minute; the dated CSV is evidence for CC8.1 and A.8.4 as well as A.5.21.
The annual cycle
Two calendar events: a quarterly comparison of the inventory against payments, and an annual reassessment of Critical and High vendors with their new reports and contract checks. Put both in the compliance calendar with an owner. A Type II auditor samples across the period, so last year’s review records are the ones you need to still have.