Skip to content
The complete guide

Third-party risk management, answered

What TPRM is, direct answers to the problems teams face most, and how to build a program that holds up. Five short sections.

01 · In one minute

What is third-party risk management?

Third-party risk management (TPRM) is how you identify, assess, monitor and reduce the risks that come from the outside organizations you rely on, across the whole relationship.
You can outsource an activity, but not the responsibility for it.

Same discipline, different names

  • Third-party risk management (TPRM)Regulators, risk and audit
  • Vendor risk management (VRM)Security and IT
  • Supplier risk managementProcurement
  • Outsourcing / ICT third-party riskEU and Asian regulators
02 · Your problem, answered

What teams ask most, and what to do

Find your problem. Each card gives the answer in one line and opens the page that covers it.

“We do not have a complete list of our vendors.”Keep one register: every vendor, its owner, its data, its services and its tier.Vendor lifecycle “Assessments take months and live in spreadsheets.”Scale review depth to the tier and collect evidence through a vendor portal, or have certified assessors do it.Vendor risk assessment “We hear about vendor breaches from the news.”Watch SEC filings, state breach notices and leak sites, matched to your vendors and confirmed before anyone is alerted.Data breach alerts “We cannot tell if a vendor got weaker since its last review.”Grade every vendor’s internet-facing security from A to F, continuously, with the trend.Attack surface monitoring “A critical vendor could go out of business.”Get alerted to bankruptcy and insolvency at the vendor, its parent and its group, and keep an exit plan ready.Financial distress alerts “Too many vendors rely on the same cloud or processor.”Map the fourth parties behind critical vendors and measure where your services concentrate.Nth-party intelligence “The board wants a clear view every quarter.”Report from the records the program runs on, not a spreadsheet built the week before.Board & executive reporting “We are not sure what our regulators expect.”Most regimes agree on risk-based due diligence, monitoring, sub-outsourcing, exit and board oversight.Regulatory coverage
03 · The lifecycle

Seven stages, one record

Every relationship moves through the same stages. The tier decides how much each one asks.

  1. 01IntakeWhat the vendor will do, its data and services.
  2. 02TierCriticality sets it; inherent risk adds exposure.
  3. 03AssessEvidence reviewed at the depth the tier sets.
  4. 04ContractSecurity, audit, notification and exit terms.
  5. 05MonitorOutside-in watch between reviews.
  6. 06ReassessOn the tier’s cadence, or sooner.
  7. 07OffboardAccess removed, data returned, exit recorded.

Tier 1 Critical

Reassessed every 12 months by default

Tier 2 High

Reassessed every 18 months by default

Tier 3 Medium

Reassessed every 24 months by default

Tier 4 Low

Reassessed every 36 months or at renewal

04 · The 360 coverage model

Every part of third-party risk, on one vendor record

An assessment shows how a vendor looked on review day; monitoring shows what changed since. Here is how each part fits. Open any of them.

01Foundation

Who are our third parties, and how much do they matter?

02Inside-out

Are their controls good enough, on the evidence?

03Outside-in

Has anything changed since the last review?

04Chain and board

Where does risk concentrate, and what do we report?

05 · Getting started

Build or mature a program in six steps

  1. 1Build an inventory you trustEvery third party, its owner, its data and its services.
  2. 2Agree a tiering policyWhat each tier requires: evidence, depth, cadence, sign-off.
  3. 3Standardize due diligenceThe same questionnaires and evidence per tier, so results compare.
  4. 4Add outside-in monitoringDecide in advance what a confirmed signal should trigger.
  5. 5Map the chainFourth parties behind critical vendors, and where you concentrate.
  6. 6Report and improveA regular board view, key risk indicators and policy updates.
Keep going: Glossary of TPRM terms What regulators expect In-depth whitepapers
FAQ

Third-party risk management FAQ

What is the difference between TPRM and vendor risk management?

Vendor risk management usually means the vendors that provide technology and services. Third-party risk management is broader: every outside party you depend on, including suppliers, partners and the fourth parties behind them. The methods are the same, and many organizations use the terms interchangeably.

How often should vendors be reassessed?

By tier. A common pattern is every year for Tier 1 Critical vendors and less often for lower tiers, with continuous monitoring in between so a material change brings a review forward.

What is the difference between inside-out and outside-in assessment?

Inside-out assessment reviews a vendor’s controls on evidence it provides, such as SOC reports and penetration tests, at a point in time. Outside-in monitoring watches what anyone can observe, such as its attack surface and breach disclosures, continuously. Together they give 360-degree coverage.

Who is responsible for third-party risk?

The organization that uses the third party. Outsourcing an activity does not outsource the responsibility for it. The board oversees the program, the business owns each relationship, and risk, security, procurement and compliance teams each play a part.

Get started

Put the whole model to work on your vendors

A tailored walkthrough with a third-party risk specialist, built around your program, your regulators and your vendors.

Book a demoTalk to sales