A vital component to any effective, comprehensive vendor risk management program is knowledge of the risks posed by vendors. SOC reports are a key component to understanding these risks; however, many organizations fail to perform a critical review of each report. Evaluation templates, along with standard reporting metrics, can be leveraged by boards and management to gain valuable insights and generate consistent, repeatable processes.