The Vendor Question That Saves the Second Meeting: Who Owns the Fix?

Every vendor risk program produces the same artifact: a spreadsheet of findings. High findings, medium findings, findings from last year's questionnaire that have been 'in remediation' for three consecutive reviews.

The spreadsheet is not the program. The program is a named owner for every open finding, a date, and evidence that will prove closure. Without those, the second meeting is a reread of the first.

Before the next vendor review, ask one question about every open item: who owns the fix?

TLDR

• A finding without an owner is a subscription to future meetings.

• Ownership means one named person on your side and one on the vendor's side.

• Closure needs evidence agreed in advance, not a status color.

• Escalate vendors whose findings age past two review cycles.

• Track concentration: one vendor with many open findings is a different problem than many vendors with one.

Findings age because ownership is ambiguous

Open findings usually sit between three parties: the business team that chose the vendor, the security team that assessed it, and the vendor itself. Each assumes another is driving the fix. The vendor, meanwhile, treats your questionnaire as one of hundreds and prioritizes the customers who escalate.

NIST's supply chain guidance frames supplier risk as an ongoing management discipline, not a point-in-time assessment. The discipline is exactly this: an owner, a plan, and evidence for every accepted or remediated finding.

Assign two owners per finding

Every open finding gets a named owner inside your company, usually the business relationship owner, and a named owner at the vendor. The internal owner chases, the vendor owner fixes. 'The account manager' is not a name.

Record the pair next to the finding. When the same two names appear on ten findings, you have learned something about that vendor's capacity, and about your own team's span.

Define the evidence before you accept the plan

'Fixed in the next release' is a promise, not closure. Agree at acceptance time what will prove the fix: a configuration screenshot, a penetration test retest, a policy excerpt, or a contract amendment. Vendors rarely object to defining evidence; they object to surprise standards later.

This fictional example shows a remediation log. It is an illustration, not a real vendor record.

Finding	Your owner	Vendor owner	Closure evidence	Due
No MFA on admin portal	R. Alvarez (Ops)	J. Smith (Vendor PM)	Retest screenshot	Aug 15
Stale SOC 2 bridge letter	T. Nguyen (Finance)	J. Smith (Vendor PM)	Updated letter	Jul 31
Unencrypted export files	R. Alvarez (Ops)	A. Chen (Vendor Eng)	Config export	Sep 1

Escalate on age, not severity alone

A medium finding that survives three review cycles tells you more than a fresh high one: it tells you the vendor does not respond to your process. Set an aging threshold that triggers escalation to contract remedies, renewal conditions, or exit planning.

Watch concentration too. Ten vendors with one finding each is routine management. One vendor with ten findings is a dependency decision, and it belongs in front of the executive who owns that dependency.

The related discussion of third-party risk reporting is worth your time alongside this one.

Frequently asked questions

Should security own vendor findings?

Security should verify closure and set the evidence standard. The fix itself belongs to the business owner of the relationship and the vendor. Making security the owner of every finding guarantees the spreadsheet grows.

What if the vendor refuses to commit to dates?

That is a commercial answer about leverage and alternatives, not a security answer. Record the refusal, quantify the residual risk, and put it in front of whoever owns the relationship and the renewal.

Does this apply to small vendors?

Yes, scaled down. The owner-evidence-date pattern costs almost nothing. What changes with vendor criticality is how much evidence you require and how fast you escalate.

A Defensible Next Step

Pull the current vendor findings list and mark every item older than two review cycles with no named owner. Fix ownership before the next review meeting, and the meeting gets shorter. Book a Decision-Clarity Call if you want a working template.