I was working on an assessment where I couldn’t get a clear picture of what the vendor was currently providing.
The internal records I would normally use weren’t helping much. I couldn’t find enough to understand what service was actually active, and there wasn’t much elsewhere in the records explaining the relationship either.
That didn’t prove the vendor was inactive.
It told me I needed a better source.
So I went back to the internal relationship owner and asked what was actually going on.
What I learned changed the assessment.
The service had never really become operational. The vendor hadn’t provided the expected service, no data had been shared, and no connection had been established.
At that point, I wasn’t missing a vendor security answer.
I was trying to figure out whether there was a current third-party relationship to assess at all.
There was another complication.
The business wasn’t eager to close the relationship completely because they wanted the option to use the vendor later if circumstances changed.
I understood that.
But keeping a vendor available for possible future use didn’t create a current service for me to assess.
The assessment was paused and ultimately stopped.
What stayed with me was where the missing answer had actually been.
Third-party assessments naturally generate questions for the third party. Most of them go outward: what the vendor hosts, what data it retains, who can access it, and which security controls are operating.
But not every open question belongs to the vendor.
Some things only the customer can tell me: what it actually bought, whether the service was ever implemented, whether anyone uses it, whether data was ever sent, or whether a connection was ever established.
If one of those facts is missing, sending another question to the vendor may not get me any closer to an answer.
Before I chase someone, I need to know who can actually answer the question.
That sounds simple, but it gets easy to lose once an assessment is already moving.
An unanswered field can start looking like vendor non-responsiveness when the real problem is that the question was never theirs to answer.
The internal records still matter, but I don’t treat an empty record as proof that nothing happened.
Not finding an agreement, implementation record, or other activity tells me where to look next. It doesn’t answer the question by itself.
In this case, the internal confirmation was what let me make the assessment decision.
It also made me think about how these questions get handled in the workflow.
If a question depends on something only the customer can confirm, that should be clear before it turns into another vendor follow-up.
A system can help send the question to the right person.
But someone still has to recognize that the answer may be sitting on the wrong side of the relationship.
When an assessment stalls on an unanswered question, do you first ask what the answer is, or who actually owns it?
