Third-Party Risk
Every vendor tiered, assessed, contracted and watched, for as long as you depend on them
Third parties, engagements, contracts, assessments and fourth-party exposure on one record set, so the risk of a vendor is read from what they touch, what they signed and how they scored, not from a spreadsheet tab.
- Inherent factors you weight decide the tier; knockout rules stop a vendor regardless of score
- Engagements scope the services, data and systems involved, each with its own tier
- Contracts carry obligations, renewals, approvals and an exit plan with a status
- Fourth parties aggregated across vendors, so a shared provider shows as one risk, not twelve
In the application · Assure
- Third-party register
- Engagements
- Contracts
- Due diligence
- Assessments
- Issues
- Concentration
- Vendor master data
Inherent risk factors
- Data classificationConfidential,
- System access levelPrivileged,
- Service criticalityHigh,
- Fourth-party reliancePresent,
Knockout rule applied. Privileged access to confidential data forces Tier 1, whatever the computed score says.
Tiering and due diligence
Tiering you configure, and a tier that can explain itself
Inherent factor rules set exposure; control domains and scoring bands set effectiveness; residual maps to a tier. Each tier sets the questionnaire depth and review schedule, and due-diligence requests are tracked to a decision with document validity on every artefact.
- Weighted tier factors per scoring profile; overrides recorded with a reason
- Questionnaires with scored responses at the depth the tier demands
- Due-diligence requests with lifecycle phase, document type and validity status
- Issues linked to the question that raised them, tracked as findings
Level 3: Well Defined
A standard process is defined and followed across the organisation.
Every question in the control library carries its own written descriptor at each level.
Engagements and contracts
A vendor is only as risky as what you engage them for
Each engagement names the services, data and systems in scope and the entities it serves, and carries its own inherent and residual tier. Contracts carry type, governing law, value and currency, auto-renewal with notice period, and the obligations the vendor owes you.
- Contract obligations by category, each with status and history
- Review decisions with recorded approvals; renewal notice before auto-renewal
- Confidential contracts with restricted access
- Substitutability, exit-plan status and a register of ICT third-party arrangements
Treatment decision
- 1Treatment planActions with owners, priority, and due dates
- 2Action trackingStatus per action, SLA where defined
- 3ReassessmentResidual score recalculated after closure
Ongoing monitoring
Onboarding is one day; the relationship is years
Review schedule rules decide, by tier and vendor type, how often a vendor is reassessed, monitored and asked for fresh evidence, and when an overdue review escalates. Third-party indicators carry thresholds; a breach opens the review before the annual date.
- Next assessment date on every vendor; overdue reviews escalated to owners
- Fourth parties and dependency links with exposure summaries and concentration alerts
- Key risk indicators with readings, thresholds and breach history
- Dashboard of tiers, expiries, open issues, overdue reviews and concentration
Privileged access review not evidenced
Traced to control · raised from assessment
Export current privileged accounts
IT Ops
Confirm owner for each account
System owners
Remove unowned accounts
IT Ops · waiting on “Confirm owner for each account”
Attach review evidence
Security · waiting on “Remove unowned accounts”
Evidence is reviewed and accepted, not just attached
Framework alignment
Works with your control frameworks
This module shares the platform control library. International standards, sector regulations and your own internal standard are loaded the same way and mapped to one another, wherever you operate.
See third-party risk in your environment
A walkthrough scoped to your entities, your frameworks, and the way your programme is actually run.