Governance, Risk & Compliance · Govern
A certificate or a completed questionnaire is often taken as sufficient assurance, when the scope behind it may exclude the very service you are buying. We assess individual vendors against the risk they carry: we scope the assessment to the data and access involved, read certifications and audit reports for what they genuinely cover and exclude, and validate the key controls rather than accept answers at face value. The output is a plain recommendation — proceed, proceed with conditions, or decline — with the reasons stated. Where a vendor will not provide evidence, that itself is recorded as a finding rather than assumed away.
In short
Vendor risk assessment evaluates a specific supplier's security, privacy and resilience posture before or during engagement. It reads behind the certificates and questionnaire answers to what is actually covered, and ends in a clear recommendation.
Start a conversationWhat we do
We establish what data and access the vendor will actually have, which sets how deep the assessment needs to go. A vendor that will hold sensitive customer data warrants far more scrutiny than one with no such access. Scoping first keeps the effort proportionate and avoids both a cursory look at a critical vendor and an exhaustive one at a trivial supplier.
We review certifications, audit reports and policies for what they genuinely cover and, importantly, what they exclude. Scope statements and statements of applicability frequently carve out the service you are buying, which changes the conclusion entirely. Reading the exclusions is usually more revealing than reading the headline certificate.
We test or question the key controls rather than accepting questionnaire answers at face value. A questionnaire records what the vendor says; validation establishes what is actually true of the controls that matter to you. For the highest-risk controls we seek evidence or a demonstration rather than an assurance.
We give a clear position — proceed, proceed with conditions, or decline — with the reasons behind it. A recommendation that hedges leaves the decision exactly where it started. Where we advise conditions, they are specific and checkable, so onboarding can proceed with the residual risk managed rather than ignored.
What you receive
Documented output your teams keep and can act on without us in the room.
When this work helps
How an engagement runs
Establish the obligations, decision rights, and risks that genuinely matter to this organisation. We separate the requirements that truly apply from those assumed to, so effort is not spent governing risks you do not carry.
Review existing controls, policy, evidence, and how the work is actually performed. We compare the control on paper with the control in practice, because the gap between the two is usually where the real risk sits.
Design a proportionate control set with named ownership, evidence, and review cadence. Every control has an owner who can operate it and a defined source of evidence, so nothing depends on memory or heroics.
Embed the changes with the teams doing the work, and test that the controls operate. We hand over controls the process owners can run themselves, rather than a framework only we understand.
Where we work
Fidova provides governance, risk and compliance consulting from Delhi, India, and works with organisations operating in several jurisdictions at once, mapping obligations across regions to one coherent control set.
Engagements run in English, are scheduled around your time zone, and can be delivered remotely end to end, with on-site time planned where a phase genuinely benefits from being in the room.
Related services
Internal IT audits independently test whether technology controls are designed well and operating as described. They replace the assertion that controls work with evidence of whether they actually did over the period examined.
A compliance gap assessment measures your current position against a framework or obligation and states what is missing. It is deliberately short, because its job is to inform a decision about scope, budget and timing, not to become the programme itself.
Control testing and assurance verifies with evidence that controls operated as intended over a period. Done on a cycle, it turns the annual scramble for evidence into a by-product of controls simply running.
Questions
Straight answers to what buyers ask us before an engagement begins.
Enquiries
Your enquiry lands in the same inbox as every other on this site and is read by us. Tell us the requirement and we will reply with a practical next step.
Prefer email? contact@fidovaadvisory.com
Next step
