CoalDark field notes

Vendor risk,
in practice.

Opinionated guidance for teams replacing spreadsheet administration with a program that produces timely, explainable decisions.

Latest notes2026 / Volume 01
01
Program design

Vendor tiering that changes the workflow

A useful tier determines assessment depth, review cadence, and approval authority. Anything less is a label.

6 min↗02
Assessments

Stop sending every vendor the same questionnaire

Questionnaire fatigue is a scoping failure. Start with the service, data, access, and business impact before choosing questions.

5 min↗03
Operations

Build a review cycle that survives the calendar

Annual review dates are not a monitoring strategy. Use events, risk tiers, evidence expiry, and ownership changes to drive the queue.

7 min↗

Have a vendor-risk operating question worth unpacking?

Send it to the team →