Understand the relationship
Record what the vendor does for your organization, what information it can access and which teams depend on the service. Those details help reviewers understand why the relationship matters.
Choose a useful review
Then choose a review cadence that reflects the service and your own risk criteria. Ask for relevant assurance material, note open questions and record who owns each follow-up.
Keep the reasoning visible
A low, medium or high label is only useful when the organization has clear criteria behind it. Document the reasoning and revisit it when the service, data access or business dependency changes.
Bring it into your next review.
A vendor score is a starting point. The context and reasoning make it useful.
Discuss your workflow with Auditstead