Third-party risk management earns its cost when it changes two things: which suppliers you depend on, and what you would do if one of them stopped. Everything else is administration.
Questionnaires are not assurance
A completed questionnaire tells you what a supplier says about itself at a point in time. It rarely tells you whether the control you depend on operates, or whether the service you buy sits inside the scope of their certification.
The gap becomes visible during an incident, when the question is not 'did they answer' but 'who do we call, what can they restore, and by when'.
Tier by dependency, not by spend
Spend is a poor proxy for risk. A small integration provider holding customer data or sitting inside a payment path can matter more than a large commodity supplier.
Tier suppliers by what breaks if they are unavailable, what data they hold, and how quickly you could replace them. Concentrate assurance effort on the top tier and accept lighter treatment elsewhere — deliberately, and in writing.
Plan for the failure you can imagine
For each critical supplier, write down the failure mode, the detection route, the immediate response, and the exit path. Test the parts you can test.
That document is worth more than a folder of certificates, and it is the thing regulators and enterprise buyers increasingly ask to see.