Every vendor, from intake to exit, in one record
Scope each relationship at intake, set its depth of due diligence by criticality, contract with conditions, monitor between reviews, reassess on cadence and exit with evidence. One governed workflow, one audit trail, for every vendor, supplier and outsourcing arrangement.
Most TPRM failures happen between the assessments
Examiners rarely criticize a single assessment. They criticize the inventory that missed a vendor, the review that lapsed, and the exit nobody can evidence.
The same vendor, five times
One questionnaire for everyone
Reviews that quietly lapse
Exits with no evidence
A lifecycle you can walk an examiner through
Each stage has an owner, required evidence and an exit condition. Nothing moves forward until it is met, and every decision is recorded.
Reassessment cadence by tier: the defaults
Your policy can shorten any cadence, and a current SOC report can set the date. Confirmed monitoring signals, new services or new data types can bring any date forward.
- 01
Intake
Business ownerThe request captures the business case, the services, the business units that will rely on them and the data types in scope. Business case plus data types decide control applicability, so the assessment asks only what matters for this relationship. A new engagement with an existing vendor joins that vendor’s record instead of creating a second one. - 02
Due diligence
TPRM teamA criticality questionnaire sets the tier, and inherent risk combines the tier with the vendor’s exposure. Sanctions screening and public-source checks run first. The vendor is invited to the vendor portal with a request list sized to its tier, from a short attestation for Tier 4 Low vendors to SOC reports, penetration tests, BCP and DR test results and financials for Tier 1 Critical ones. Requests to Tier 1 and Tier 2 vendors are approved by a second person before they are sent. - 03
Assessment
Analyst and reviewerA point-in-time, inside-out review of the vendor’s controls across 30+ control domains, based on the artifacts it provided. Your analysts review the evidence, record ratings, findings and notes, and sign off. SOC reports are reviewed for exceptions, carve-outs, subservice organizations and CUECs. With Managed Vendor Risk Assessments, VendRisk360 assessors perform the assessment for you. - 04
Contracting
Procurement and legalFindings that must close before signature become pre-contract conditions. Residual risk goes through the risk acceptance workflow where needed, and multi-stage sign-off with segregation of duties issues a sign-off certificate. Contract and renewal dates are recorded on the vendor record and drive the next review. - 05
Monitoring
OngoingContinuous, outside-in monitoring across the vendor’s external attack surface, shadow infrastructure, indicators of compromise, breaches and security incidents, adverse news and litigation, regulatory and enforcement actions and sanctions. Alerts fire only after a signal is confirmed, and each lands on the vendor record for the owner to act on. - 06
Reassessment
Cadence or triggerRecertification is the scheduled review. The next due date comes from the vendor’s SOC report coverage or from the cadence of its tier (by default every 12 months for Tier 1 Critical, up to 36 months for Tier 4 Low), and the platform tracks every date. Owners are reminded before the due date and overdue reviews escalate. A confirmed high-severity signal, a new service or a new data type can bring the date forward. - 07
Offboarding
ExitStarting offboarding records the reason, the contract end and a target date set by criticality, and opens the exit checklist with owners and due dates: access revocation, return or destruction of data, transition of services, and final invoices or obligations. Data return and access removal need proof before they can be completed, and the vendor can upload its destruction certificate in the vendor portal. The relationship closes only when every step is done, and the offboarding record stays on the vendor for audit and examination.
Ask the right questions, of the right vendor
Two intake answers do most of the work: why the business needs the vendor, and what data it will touch. From those, VendRisk360 derives which control domains apply and how deep the review goes.
- Business case, services and relying business units captured up front
- Data types in scope: personal data, cardholder data, PHI, confidential and regulated data
- Control applicability derived automatically, then adjustable by the analyst with a reason
- One record per vendor: new engagements join the existing record
Business case
Outsourced card payment processing
Data types
Control domains in scope
- Access management
- Encryption and key management
- Business continuity and DR
- Incident response and notification
- Subcontractor oversight
- Privacy and data retention
Illustrative example
Recertify what you have. Exit what you no longer need.
Assurance is only as current as its last review. Exits are only as good as their evidence.
Recertification and contract renewal
Every vendor carries its next review date and its contract end date, tracked separately. The review date follows the vendor’s SOC report coverage or the cadence of its tier; the contract date prompts the owner to renew or offboard in time. Both show in the Ongoing view when they fall due.
- Next review from SOC report coverage or the tier cadence
- Reminders before the due date, escalation when a review is overdue
- Contract reminders that lead to a renew or offboard decision
Offboarding with exit evidence
DORA, the EBA outsourcing guidelines and APRA CPS 230 all expect documented exit strategies for critical services. When a relationship ends, an offboarding checklist tracks each step and a relationship cannot close without the proof.
- Exit checklist with owners, due dates and reminders
- Data return and access removal completed only with proof
- The vendor uploads its certificate in the vendor portal
- Offboarding record kept as PDF and Excel for auditors and examiners
Know where every vendor stands, and how long it takes
Onboarding, ongoing, offboarding and closed are views of the same vendor list, so each team sees its own work and nobody keeps a side spreadsheet. Targets by criticality show what is running late.
- Onboarding, Ongoing, Offboarding and Closed views, each with its own filters
- Onboarding and offboarding targets by criticality, with past-target flags
- Every status change recorded with who made it and why
- Vendor Lifecycle Report in PDF and a multi-tab Excel workbook, scheduled to your committee
Vendor Lifecycle Report, this quarter
New vendor requests
14
Onboarded
9
Median days to onboard
26
Offboardings closed
3
Illustrative example
Vendors work their stage in the vendor portal
Due diligence requests, questionnaires, evidence and remediation all go through one portal with one-time-code access. Your team tracks each vendor's stage from the lifecycle views instead of an inbox.
Whatever your regulator calls it
The discipline has a different name in every market. The platform structures the same lifecycle to the vocabulary and records each regime expects.
| Market or sector | What it is called | Key references |
|---|---|---|
| United States | Third-party relationships | Interagency Guidance (Fed, FDIC, OCC), NCUA for credit unions and CUSOs, FFIEC |
| European Union | ICT third-party arrangements, outsourcing | DORA register of information, critical or important functions, EBA Guidelines on outsourcing |
| United Kingdom | Outsourcing and third-party risk | PRA SS2/21, material outsourcing, operational resilience |
| Australia | Material service providers | APRA CPS 230 and CPG 230, material arrangements |
| Singapore | Material outsourcing | MAS Guidelines on Outsourcing |
| India | Outsourcing of IT services | RBI Managing Risks in Outsourcing Directions (2025), material outsourcing |
| Healthcare | Business associates | HIPAA business associate agreements and safeguards |
| SaaS and data processors | Sub-processors | GDPR Article 28 processor and sub-processor obligations |
VendRisk360 is aligned to these frameworks. Each organization remains responsible for its own compliance.
See global regulatory coverageFrequently asked questions
Can we see how long onboarding takes?
Yes. Each criticality tier has an onboarding target and an offboarding target, set in your program. Vendors past their target are flagged in the lifecycle views, and the Vendor Lifecycle Report shows new requests, decisions, median time to onboard by tier and how many decisions met their target.
What is vendor lifecycle management?
Vendor lifecycle management is governing each third-party relationship from the first request through due diligence, contracting, ongoing monitoring, periodic reassessment and termination. Regulators in the US, EU, UK, Australia, Singapore and India all describe this lifecycle, and expect the depth of oversight to match the criticality of the service.
How does intake decide which controls apply?
The requester states the business case and the data types the vendor will access or process, such as customer personal data, cardholder data or protected health information. VendRisk360 uses both answers to determine which control domains apply, so the questionnaire and evidence list fit the relationship.
How often are vendors reassessed?
Cadence follows the tier. By default Tier 1 Critical vendors are reassessed every 12 months, Tier 2 High every 18 months, Tier 3 Medium every 24 months and Tier 4 Low every 36 months, and your TPRM policy can shorten any of them. When a vendor has a current SOC report, its coverage period can set the date instead. Confirmed monitoring signals, new services or new data types can trigger an earlier reassessment.
Can the vendor record serve as our DORA register of information or outsourcing register?
The vendor record holds the relationships, services, criticality, contract dates, locations and subcontractors that registers such as the DORA register of information, the EBA outsourcing register and APRA CPS 230 material arrangements draw on, and the data exports to Excel. Your compliance team remains responsible for the final regulatory submission and its format.
What does offboarding record?
The reason, the contract end and the target date; each exit step with its owner, due date and completion date; and the evidence: access revocation, data return or destruction certificates (uploaded by your team or by the vendor in the vendor portal), service transition and closure of obligations. Every status change is recorded with who made it and why. The offboarding record exports to PDF and Excel, and the vendor record and its history remain available to auditors after the relationship ends.
What is recertification?
Recertification is the scheduled review that keeps a vendor’s assurance current. Its due date comes from the expiry of the vendor’s SOC report coverage or from the review cadence of its tier. Reminders go to the relationship owner and the TPRM team before the date, evidence is requested from the vendor through the vendor portal, and an overdue review escalates. Contract end dates run on their own reminders, so the owner decides in time whether to renew or start offboarding.
See VendRisk360 on your own vendors
A tailored walkthrough with a third-party risk specialist, built around your program, your regulators and your vendors.