Skip to content
Compliance & Audit agent

Vendor risk reviews

Each new vendor gets the security questions that fit the data it will touch. Its answers are read against its own audit report, and anything that doesn’t hold up goes to your security lead.

  • $12,500 fixed
  • Live in 3 to 6 weeks
  • Yours to keep
Let’s build your agent How it works
The review screen for Vendor risk reviews: four items, three done, and one (Answers disagree) waiting for the security lead, who is asked: Fernhill says every login uses MFA. Their SOC 2 report notes an exception. Ask them?
How it works

Not just the questionnaire. The audit report behind it, too.

Here’s a typical run, step by step: what automation handles, what the agent does, and the calls that stay with your team.

The workflow for Vendor risk reviews, in 5 steps. It starts with “A new vendor is requested” and ends with “A decision on record”. Each step lists what automation, the agent and your team do there.
Vendor risk reviewsA typical run
Starts withA new vendor is requestedMarketing asks to add Fernhill Analytics, a web analytics tool that would read customer data.
The agent: Reads the request and the vendor’s own documentation to see what data and systems it would reach. Fernhill would read customer browsing data.
Automation: Sets the tier from your rules and sends the vendor the questions and documents that tier asks for.
~3h/mo

Step 1 of 5Size the review

  • The agent

    Reads the request and the vendor’s own documentation to see what data and systems it would reach. Fernhill would read customer browsing data.

    Requests rarely say it plainly. “Better web reporting” can mean a script on every page of your site.

  • Automation

    Sets the tier from your rules and sends the vendor the questions and documents that tier asks for.

    Once the data is known, the tier and its questions are your rule.

Reads
  • Request queue
Writes
  • Vendor register

~3 hours a month back

Where teams differSome teams review every vendor. Others only the ones that touch data or connect to their systems.

Automation: Reminds the vendor contact until the questionnaire, the audit report and the insurance certificate are back, and logs each one.
~5h/mo

Step 2 of 5Collect the answers

  • Automation

    Reminds the vendor contact until the questionnaire, the audit report and the insurance certificate are back, and logs each one.

    Chasing documents is the same polite note each time.

Reads
  • Email
Writes
  • Vendor register

~5 hours a month back

The agent: Reads each answer against the SOC 2 report, scope and exceptions included. Fernhill says every login uses MFA. Page 38 notes an exception.
~18h/mo

Step 3 of 5Read the evidence

  • The agent

    Reads each answer against the SOC 2 report, scope and exceptions included. Fernhill says every login uses MFA. Page 38 notes an exception.

    Vendors answer questionnaires in their best light. The exceptions in the audit report are where the detail lives.

Reads
  • Vendor documents
Writes
  • Vendor register

~18 hours a month back

Where teams differWhat counts as proof varies: a SOC 2 report, an ISO 27001 certificate, or a pen test summary.

Automation: Anything below your bar goes to the security lead with the answer, the page it contradicts and the vendor’s tier.
IfYour team: Asks Fernhill to show the exception is fixed, approves with a condition written into the contract, or says no.
~3h/mo

Step 4 of 5Settle the gaps

  • Automation

    Anything below your bar goes to the security lead with the answer, the page it contradicts and the vendor’s tier.

    Your bar is written down, so what falls below it reaches a person without anyone sorting it.

  • Your teamIf an answer doesn’t hold up

    Asks Fernhill to show the exception is fixed, approves with a condition written into the contract, or says no.

    Taking on a vendor’s risk is a call for whoever answers for security.

Reads
  • Vendor register
Writes
  • Vendor register

~3 hours a month back

Automation: Files the review with its evidence and the decision, tells marketing and procurement, and sets a date to look again by tier.
~3h/mo

Step 5 of 5Record the decision

  • Automation

    Files the review with its evidence and the decision, tells marketing and procurement, and sets a date to look again by tier.

    The decision is a person’s. How soon to look again is set by the vendor’s tier.

Reads
  • Vendor register
Writes
  • Vendor register
  • Request queue

~3 hours a month back

Ends withA decision on recordThe review filed with its evidence and the decision, and a date set to look again.
Total~32h/mo

What changes

Vendors get the questions their tier calls for, and each answer is read against their own audit report. Your security lead only sees what doesn’t hold up.

  • 4steps automated
  • 2steps for the agent
  • 1call kept with your team

Pick any step to see what happens there and why it sits in that lane.

What it could be worth

~32 hours a month back

$26,900 a year in time

For a company reviewing about 6 new vendors a month, plus its yearly re-reviews, at $70 an hour. We work out yours from your own volumes before you sign.

Let’s build your agent
What we customize with you

One proven agent, plugged into how you work.

Every team does this job a little differently, so we set these five with the people who do it today. We’ve done this in dozens of businesses, so we know where teams usually differ and ask about those first.

The agent

Same for every client
  • Follows the same proven steps
  • A person on every exception
  • Every decision logged
  • Tested on your past work first
  • Never approves a vendor or accepts a risk on its own

  1. Your systems

    Where the work comes in, and where the result goes.

    For this agentRequests from your procurement or ticketing tool, reviews into your vendor register.

  2. Your rules

    The limits and exceptions it works to.

    For this agentWhich vendors need a review, what each tier asks for, and what counts as a pass.

  3. Your team

    Who signs off, and who covers when they’re away.

    For this agentThe security lead for anything below the bar, legal for contract terms.

  4. Your channels

    Where your team hears from it.

    For this agentEmail to vendor contacts, Slack for your team, a monthly list for compliance.

  5. Your output

    What it hands back, in the format you already use.

    For this agentA filed review per vendor, with the evidence and the decision on record.

It gets a vendor to a security decision. Approving the tool itself is the Software vendor approval agent, and whether a risk is worth taking stays with your team.

What you get

The agent, and everything that keeps it working.

  • The agentRunning on your systems, under your rules.
  • The review screenWhere the exceptions land for your security lead and whoever asked for the vendor.
  • Your rulebookYour limits, exceptions and who signs off, in one place, often for the first time.
  • A test reportYour past vendor reviews, run through it and checked against the number.
  • The runbookHow it works, what to check, and what to do if it stops.
  • 30 days of tuningAfter it goes live, through a full month of your real vendor reviews.
The number we agree

Days from a vendor request to a security decision. We measure your last ten reviews, then the first month it runs.

How we get there

Live in 3 to 6 weeks. About seven hours of your time.

We do the building. Your side: access, your questionnaire and your last dozen vendor reviews, and a short weekly check-in.

  1. Before kickoff

    We send the access checklist.

    You, 2 hours. Access, an owner, and your questionnaire and your last dozen vendor reviews.

  2. Weeks 1 to 2

    We connect your systems and set it up.

    You, 1 hour. Walk us through your rules.

  3. Weeks 2 to 4

    We test it on your past vendor reviews.

    You, 1 hour. Review what it flagged.

  4. Weeks 3 to 6

    It runs beside your team, then goes live.

    You, 1¼ hours. Work from the review screen.

Then 30 days of tuning, with a short check-in each week, about two hours of yours. At day 30 we show you the number and hand everything over.

After it’s live

It keeps running whether or not we stay.

  • It runs in your accounts

    Your cloud, your systems, and an AI account in your name, billed by the provider at their rates.

  • Changes in the first 30 days are included

    A new rule, a changed limit, someone new signing off. That’s what tuning is for.

  • After that, your call

    Your team edits the rulebook, the care plan covers it, or a bigger change is quoted first.

Questions

About this agent.

Does it use our questionnaire?
Yes. Yours, cut to fit each tier, so a caterer isn’t asked how it encrypts customer data.
What if the vendor has no SOC 2 report?
Your rules say what counts instead, like an ISO 27001 certificate, a pen test summary or a longer questionnaire. It asks for that and reads it the same way.
What about vendors we already use?
Each review sets a date to look again, sooner for vendors that touch more data. When that date comes round, it runs the same review.
Our process isn’t quite like this. Will it still work?
That’s the usual case. The job looks the same in most businesses, but the details never do. We map how your team does it today, then set the rules, systems and approvals to match. That’s what most of the 3 to 6 weeks are for.
How do we agree the number?
Together, before any work starts. For this agent it’s the days from a vendor request to a security decision. We measure your last ten reviews, then the first month it runs.
What does it cost to run once it’s live?
Hosting and AI, paid straight to the providers, not through us. It usually runs 5x to 25x cheaper than doing the same work by hand, and we work out your figure from your real volumes before you sign.

Who reads your vendors’ audit reports today?

Tell us how your team handles vendor reviews today. We’ll show you this agent on examples like yours, and whether it fits the fixed price.

Let’s build your agentBack to Compliance & Audit
New to Switchboard Agents? How it works, what’s included, and what it costs.
  • 3 to 6 weeksto live, then 30 days of tuning
  • $12,500fixed, per agent
  • Yours to keepno license fees
See the service
Switchboard Agents$12,500 fixed · live in 3 to 6 weeks How it works Let’s build your agent