Your firm has a vendor risk process. Somebody sends questionnaires to suppliers, reviews their attestations, tracks the ones with access to client data, and escalates the ones that answer badly.
Now turn it around. When an institutional client, a platform partner or a large employer sends you the same kind of review, who answers it? Usually whoever is available, from memory, under deadline, without a canonical source.
The firm has built the muscle for evaluating others and none for being evaluated.
Why this matters more each year
Being diligenced is no longer occasional. It is a routine condition of winning larger clients, joining platforms, and maintaining bank and custodial relationships. The reviews are getting longer and more specific, and increasingly they ask for evidence rather than assertions.
That means the security posture of a financial firm has become a commercial capability. It shows up in win rates, in onboarding timelines, and in whether a large account gets past procurement at all.
Most firms of this size have never framed it that way. It sits with compliance as an obligation rather than with the business as an asset.
The three things reviewers actually judge
Whether the answers are consistent. Reviewers compare what you say now with what you said last cycle, and sometimes with what your peers said. Inconsistency reads as a firm that does not know its own environment.
Whether the gaps are acknowledged. Nobody expects a hundred-person firm to have a mature programme in every domain. A gap with an owner, a plan and a date reads as competence. An unqualified clean sheet invites a deeper look, and the deeper look usually finds something.
Whether somebody senior owns it. The single strongest signal is a named accountable person who can speak to the programme without reading from a script. Its absence is the most common finding in firms this size.
Turning it from a cost into an advantage
Firms that get good at this stop treating each review as a project and start treating the underlying evidence as a maintained asset. The practical effect is that a review that used to take three weeks of partner time takes two days of coordination.
The commercial effect is larger. A firm that can respond to a vendor review quickly, accurately and with evidence gets through procurement faster than the competitor who cannot, and procurement timelines are frequently what decides a mandate between two firms the client already likes.
There is a second-order benefit too. The same evidence set answers your regulator and your insurer, which means the work is being done once for three purposes rather than three times for one each.
The subcontractor question you will be asked
One question catches firms out consistently: who do you rely on, and what do they see?
Your clients' reviewers care about your suppliers because your suppliers are their fourth parties. If you cannot produce a current list of who processes client data on your behalf, what each of them sees, and what your contract with them says, the review stalls there.
That list is worth having regardless. It is also the list that makes your own vendor risk programme real rather than performative.