Skip to content
Indian regulation

Ninety vendors, one assessment cycle: eleven weeks to nineteen days

The bottleneck was never the questionnaire.

Aparna Iyer2 min read
Ninety vendors, one cycle — cover illustration

The situation

An urban co-operative bank with ninety active vendors ran its annual third-party assessment out of a shared workbook. Two people owned it. The cycle ran eleven weeks, most of which was spent chasing attachments over email.

Ninety vendors, one cycle — cover illustration
Where the eleven weeks went — chasing, not assessing.

What changed

BeforeAfter
Cycle time11 weeks19 days
Vendor response rate54%91%
Evidence chased by emailEvery vendorExceptions only
Findings with a named ownerUnknown100%

The response-rate change did the real work. Vendors were not refusing to answer; they were losing the request in an inbox. A portal with its own reminder schedule removed the step that was failing.

We did not make the assessment shorter. We stopped losing it in email.
— Head of Risk

What we would do differently

Tiering should have come first. The first cycle sent the full questionnaire to all ninety vendors, including the ones whose failure would have been an inconvenience rather than an incident. The second cycle sent a nine-question version to forty of them and finished a week earlier.

Facts last verified 18 Aug 2026

Was this useful?
ShareLinkedInXEmail
Written by
Aparna Iyer
Head of Compliance Research · CISA, ISO 27001 Lead Auditor
Reviewed by M. Raghavan, CA, DISA (ICAI)

Related reading

See KashiGuard on your own process.

A 30-minute demo built around the vendors, audits and frameworks you deal with today.