The Vendor File That Passes Every Review and Proves Nothing

COMPLIANCE | VENDOR & THIRD-PARTY RISK

Written by: Devensa AI

Figure: 83% of organizations identified third-party risks after due diligence and before recertification, the period an onboarding-centered vendor file does not cover. Source: Gartner (2019).⁴

A vendor file proves compliance only when it shows oversight happened: diligence scaled to risk, verified controls, and monitoring across the relationship. Many files show only that documents were collected. In a Gartner survey of executive risk committee members, 33% reported regulatory action tied to a third-party risk management issue.¹

Complete Is Not the Same as Effective

Open a typical vendor file and you find a signed contract, a completed questionnaire, a SOC 2 report, an insurance certificate, and a sanctions screen. Each item is real. Together they can still prove nothing, because each describes a moment, and none shows that anyone read, questioned, or acted on it. The file passes internal review because reviewers check that documents exist, not what the documents reveal.

Third-party compliance, properly defined, is the ability to demonstrate that vendors were managed in proportion to their risk, for the life of the relationship, under a program that operates in practice. It is often reduced to onboarding paperwork. Prosecutors and regulators no longer accept that version.

What Examiners Now Ask

The DOJ wants lifecycle evidence

The DOJ Criminal Division’s Evaluation of Corporate Compliance Programs, last updated in September 2024, asks whether third-party management allows vendors to be reviewed in a timely manner and how the company uses available data to evaluate vendor risk during the relationship.²³ An onboarding file cannot answer that question.

Risks surface after the diligence

Gartner research found that 83% of legal and compliance leaders identified third-party risks after due diligence and before recertification.⁴ A file built around the onboarding moment misses the period when risk tends to appear.

Third parties are where incidents start

Verizon’s 2026 DBIR found a third party involved in 48% of breaches, up 60% in a year.⁵ In IBM’s 2026 breach data, supply chain compromise ranked first among 30 cost factors, adding $227,250 per breach.⁶ After an incident, the vendor file becomes an exhibit.

Figure: Supply chain compromise, shadow IT, and non-compliance with regulations each added more than $200,000 to the average breach, while a DevSecOps approach reduced it by $253,805. Sources: IBM Cost of a Data Breach Report 2026, via Reflectiz and Cycode.⁷⁶

This is where the platform’s vCCO capability, an AI-powered vOfficer augmented by Devensa subject-matter experts where needed, is designed to focus: on whether the evidence in a vendor file demonstrates oversight, not only whether the file is full.

Reading a SOC 2 Report Like an Examiner

A SOC 2 Type II report is strong evidence when it is read and weak evidence when it is only filed. Four parts deserve attention:

• Scope and carve-outs: confirm the services you use are in scope, and note subservice organizations carved out of the report.
• Complementary user entity controls: the report lists controls the vendor assumes you perform. If you do not perform them, the opinion does not cover your risk.
• Exceptions: deviations found in testing appear in the auditor’s results. A clean opinion can still contain exceptions relevant to you.
• Period and bridge: a report covering last year does not cover today. Request a bridge letter for the gap.

The Seven Elements, Applied to Vendors

The seven elements of an effective compliance program in the U.S. Sentencing Guidelines (§8B2.1) translate directly to third parties: written standards that bind vendors through contract; oversight by accountable senior personnel; due care in delegating authority to agents and intermediaries; training and communication that reach vendor-facing staff; monitoring, auditing, and reporting channels that cover third parties; consistent enforcement, including consequences for vendors that breach terms; and response and remediation when a third-party issue surfaces.

Devensa AI scores this through TruMaturity™, the methodology and six governance domains shared across Devensa. On the platform, the TruMaturity™ Assessment is designed as an AI-mediated, adaptive assessment, triggered on first sign-in and roughly annually after that, with scores mapped to the five CMMI maturity levels. For vendor compliance, the levels read like this:

• Level 1, Initial: Vendor files are assembled ad hoc, when someone asks for them.
• Level 2, Managed: A standard onboarding checklist is followed and documents are stored.
• Level 3, Defined: Diligence depth follows risk tier, and reviewer findings are documented.
• Level 4, Quantitatively Managed: Monitoring results, exceptions, and remediation are tracked with dates and owners.
• Level 5, Optimizing: Findings reshape contract templates, tiering criteria, and training.

Turning a Document Pile Into Evidence

1. Record the reviewer’s reading. For each key document, note who reviewed it, what they found, and what they decided.
2. Map CUECs to owners. Assign every complementary user entity control in a critical vendor’s SOC 2 report to a named control owner.
3. Close the period gap. Diary report expiration dates and request bridge letters on schedule.
4. Add in-relationship triggers. Adverse media, ownership changes, and incidents should reopen the file between cycles.
5. Sample your own files. Pull five critical vendor files each quarter and test them against the DOJ’s lifecycle questions.

Frequently Asked Questions

What should a compliant vendor file contain?

Beyond contracts and diligence documents, it should show the risk tier and rationale, reviewer findings, decisions and approvals, monitoring results, exceptions, and remediation over the life of the relationship.

Does a SOC 2 report satisfy vendor due diligence?

It is strong evidence for the controls and period it covers. It does not cover carved-out subservice organizations, your own complementary user entity controls, or the time since the period ended.

What does the DOJ expect from third-party management?

The Evaluation of Corporate Compliance Programs asks whether third-party management is risk-based, timely, and continues through the relationship using available data, not only at onboarding.²

How often should vendor files be refreshed?

On a risk-based cycle, with critical vendors reviewed at least annually, and whenever a trigger event occurs, such as an incident, ownership change, or adverse finding.

Who is accountable for vendor compliance?

Senior leadership and the board hold accountability, compliance designs the program, and business owners operate it for their vendors. If a regulator pulled one of your critical vendor files tomorrow, would it show a decision or only a document?

Sources

1.  Corporate Compliance Insights, “Gartner: 84% of Enterprise Risk Management Teams Have Overlooked a Third-Party Issue,” reporting Gartner’s September 2022 survey of 100 executive risk committee members (March 2023). https://www.corporatecomplianceinsights.com/gartner-erm-miss/

2.  U.S. Department of Justice, Criminal Division, Evaluation of Corporate Compliance Programs (updated September 2024). https://www.justice.gov/criminal/criminal-fraud/page/file/937501/dl?inline=

3.  Miller & Chevalier, “DOJ Releases Updated Evaluation of Corporate Compliance Programs Guidance” (2024). https://www.millerchevalier.com/publication/doj-releases-updated-evaluation-corporate-compliance-programs-guidance

4.  Gartner, “Gartner Says More Than Eight in 10 Organizations Discover Third-Party Risks After Due Diligence Period” (August 15, 2019). https://www.gartner.com/en/newsroom/press-releases/2019-08-15-gartner-says-more-than-eight-in-10-organizations-disc

5.  Verizon, “Breach entry point, 2026 DBIR finds” (2026 Data Breach Investigations Report news release, May 19, 2026). https://www.verizon.com/about/news/breach-industry-wide-dbir-finds

6.  IBM and Ponemon Institute, Cost of a Data Breach Report 2026, supply chain cost-factor findings as analyzed by Cycode (August 6, 2026). https://cycode.com/blog/ibm-cost-of-data-breach-2026/

7.  IBM and Ponemon Institute, Cost of a Data Breach Report 2026, cost-amplifier rankings as summarized by Reflectiz (August 2026). https://www.reflectiz.com/blog/ibm-cost-of-a-data-breach-report-2026/

This article is provided for informational purposes only and does not constitute legal or compliance advice. Consult qualified counsel before making governance decisions.