How to make in-depth audits scale across your vendor base

Why audits become a bottleneck

You rely on in-depth assessments to understand risk in your most critical vendors/suppliers.

But that model creates pressure:

• Audits are time-intensive and resource-heavy

• Cost per vendor can be significant

• The same vendors are often assessed by multiple financial institutions

• Regulatory expectations and internal risk appetites vary

• Audits can overlap with recognised standards such as ISO 27001 or SOC 2

This leads to a trade-off:

Depth vs coverage.

You either assess a small number of vendors thoroughly or spread effort across a broader population with less depth.

Why doesn’t in-depth assessment scale? 

Most audit models operate independently across institutions.

Each organisation:

• Commissions its own audits

• Defines its own scope

• Reviews similar controls separately 

This creates duplication at an industry level.

Vendors are often asked to support multiple audits covering similar areas, while internal teams repeat similar assessment activity.

The outcome:

• Increased cost and effort across institutions

• Slower assurance processes

• Vendor fatigue and reduced engagement

The issue isn’t the need for depth. It’s how that depth is coordinated across the industry.

What is FSQS Stage 3? 

FSQS Stage 3 is a shared audit model developed by financial institutions.

It builds on existing vendor data from FSQS and recognised external assessments such as ISO 27001 and SOC 2.

Instead of each firm auditing the same supplier separately:

• A single, in-depth assessment is conducted

• Findings are documented in a structured report

• Outputs can be made available to participating institutions

This creates a consistent, reusable view of vendor assurance that complements existing audit and certification frameworks.

How firms are starting to scale in-depth audits

1. Reduce duplication across institutions
A pooled audit approach reduces repeated assessment activity across firms, while maintaining depth of insight.

2. Focus effort on real gaps
By using existing data and recognised certifications, teams can focus on areas that require deeper review rather than repeating baseline assessments.

3. Improve supplier engagement
Vendors are subject to fewer repeated audits, improving engagement and the quality of responses.

Leading firms are moving in this direction to balance depth, coverage and efficiency across their vendor base.

What this looks like in practice

The bottom line 

Scaling in-depth audits isn’t about doing more. 

It’s about reducing duplication and coordinating how assurance is delivered across the industry. 

When that happens, you can maintain depth while improving efficiency and reducing vendor burden.