Most vendor risk programs start the same way: a spreadsheet, a questionnaire template, and a handful of critical suppliers. It works well - until the vendor list grows past the point one person can track by hand.
Here's what tends to break first, and the practical steps that keep a third-party risk program manageable as it scales.