The four common strategies are risk avoidance, risk reduction (mitigation), risk transfer such as insurance or contractual terms, and risk acceptance. Applied to vendors, you might avoid a risky supplier, require them to fix gaps, shift liability through contract clauses, or formally accept a low residual risk. Most programs use a mix depending on how critical the vendor is.
