Vendor risk assessment examines operational, financial, cybersecurity, compliance, reputational, and strategic risks posed by external service providers. The process typically involves questionnaires, on-site audits, financial analysis, security testing, and reference checks, with assessment depth proportional to vendor criticality. Results inform vendor selection, contract terms, monitoring requirements, and contingency planning. A healthcare system assessing a medical device vendor would evaluate FDA compliance history, product reliability data, cybersecurity vulnerabilities (especially for connected devices), business continuity plans, and insurance coverage, ultimately classifying the vendor as high-risk requiring quarterly reviews or low-risk with annual assessments.