Third-Party Risk: New Vendor Onboarding Review

You're a Risk Advisory intern at Grant Thornton, staffed on an engagement for a mid-size
client. The client's procurement lead describes their current vendor onboarding process:

THE PROCESS:

1. A business unit identifies a vendor and emails procurement with the vendor's name and contact info.
2. Procurement creates the vendor in the system and issues a PO — no separate check of the vendor's financial stability, ownership, or sanctions status.
3. First payment is made against the PO once goods/services are received.
4. Annually, procurement reviews the full vendor list for duplicates.
5. There is no requirement to re-verify a vendor once onboarded, even years later.

YOUR TASK:
Identify 2–3 specific risks in this vendor onboarding process, note what could go wrong
for the client (be concrete — financial, reputational, or compliance exposure), and
draft 1–2 sentences per risk that you'd actually say to the client in a findings
readout — plain language, not jargon.

Then record a 2–3 minute video explaining your reasoning, and describe one moment where
you used an AI tool to help think through this and one place where you changed or didn't
trust what it gave you.