What the assessment says. What closer review actually shows.
VendorGaps is a TPRM publication about the judgment problems that surface when questionnaire responses, supporting evidence, contracts, scope, and actual vendor activity do not fully line up.
For third-party risk, vendor risk, security, and assurance professionals who work through the details behind an assessment.
Where the gaps show up
Questionnaire answers vs. supporting evidence
Historical scope vs. current scope
Contract status vs. actual activity
Policy vs. operating practice
Prior assessments vs. current implementation
Ownership, acquisitions, data flows and unresolved risk