Third-party risk management has spent years perfecting the art of assessing vendors. We classify them, tier them, send questionnaires, collect evidence, review findings, assign scores, and place them neatly into red, amber, and green boxes. We then report how many assessments were completed, how many issues remain open, and how many suppliers have been designated high risk. It is an impressive administrative machine. It is also too often disconnected from how third-party risk affects the business.