Third-party risk management
Building and running a third-party risk program.
4 posts
How often should you reassess vendors? Cadence by tier
There is no single right reassessment cadence. Set it per tier in your own policy, anchor the clock on current evidence, and let events such as a breach or an ownership change bring a review forward.
How to map vendor tiers to inherent risk (with a matrix)
Inherent risk combines a vendor's tier (the impact if it fails) with its exposure (how likely harm is). A simple, configurable matrix maps the two, and floors and overrides keep the result honest.
Inherent risk vs residual risk in vendor management
Inherent risk is a vendor's risk before its controls are considered. Residual risk is what remains after controls are tested on evidence and findings are treated, and it should never exceed inherent risk.
What is vendor tiering? A practical guide to the four tiers
Vendor tiering sorts every third party into a risk band, usually four tiers plus a recorded exemption, so evidence, monitoring, sign-off and reassessment scale with the harm each vendor could cause.
See VendRisk360 on your own vendors
A tailored walkthrough with a third-party risk specialist, built around your program, your regulators and your vendors.