A vendor that represents a great deal of risk to an organization. In order to determine if a vendor is high risk or not an organization must assess them based on the guidance in place which outlines the categories of regulatory risk that should be considered. For example, reference FDIC FIL-44-2008. Due to the guidance, you must formalize questionnaires to assess and determine the level of risk each vendor poses to the organization.