ProcessUnity 2026 Report Finds Gaps in Third-Party Risk Assessment Maturity

Article Details

Publisher

ProcessUnity, in collaboration with Ponemon Institute

Scope

Global survey of third-party risk assessment practices, maturity, resourcing, vendor engagement, remediation, and incident outcomes across North America, EMEA, and APAC.

Sample Size

1,465 third-party risk practitioners, managers, and leaders; 632 in North America, 402 in APAC, and 431 in EMEA.

Key Statistics

• Respondents reported an extrapolated average of 12 third-party breaches or security incidents per organization over the preceding 12 months.
• 53% rated their third-party risk assessments as effective or highly effective, while only 49% measured program effectiveness.
• 63% reported that a single third-party assessment required more than 40 team-hours, including 28% requiring more than 160 hours.
• Organizations assessed an extrapolated average of 36% of their third-party population; only 15% assessed 76–100% of vendors.
• Only 16% reported completing 90–100% of remediation before onboarding; 18% completed no remediation before onboarding.

Recommendations

• Focus automation on questionnaire distribution and collection, response validation, evidence handling, and issue tracking rather than automating entire assessments end-to-end.
• Integrate assessment data, remediation status, and risk ratings into existing procurement, security, legal, and business workflows.
• Measure effectiveness through assessment cycle time, portfolio coverage, remediation completion, and reduction in repeat findings rather than activity counts alone.