Third Party Risk Management and Vendor Assessment

Flow chart of the Third Party Risk Assessment (TPRM) engagement, 6 phases in order, each one selectable. Phase 1, Vendor Inventory and Tiering. We build a full list of your third parties and tier them by the risk each one carries to your data and operations. Activities: Compile the vendor list from procurement and finance; Identify what data and access each vendor holds; Define tiering criteria by data sensitivity and criticality; Assign each vendor to a risk tier. Hands over Vendor Inventory with Risk Tiering. Phase 2, Assessment Framework Design. We design questionnaires and criteria that match each tier, so critical vendors get real scrutiny and low-risk ones stay light. Activities: Build tier-specific questionnaires from SIG and ISO 27036; Set scoring criteria and pass thresholds; Define evidence requirements per tier; Agree escalation rules for failed assessments. Hands over Assessment Framework and Questionnaire Set. Phase 3, Due Diligence Assessment. We assess your key vendors against their controls, certifications, and evidence, and score the findings. Activities: Issue questionnaires to in-scope vendors; Review SOC 2 reports and certifications supplied; Validate answers against supporting evidence; Score findings and flag unacceptable risks. Hands over Vendor Due Diligence Reports. Phase 4, Risk Treatment and Contracts. We help you address gaps through remediation, contract clauses, and clear security requirements. Activities: Agree remediation plans with high-risk vendors; Draft security and breach notification clauses; Update contracts at renewal points; Record accepted risks with business sign-off. Hands over Risk Treatment Plan and Contract Clause Library. Phase 5, Ongoing Monitoring. We set up continuous monitoring and reassessment cadences so vendor risk stays visible after onboarding. Activities: Enrol critical vendors in security rating monitoring; Set reassessment cadences per tier; Configure alerts for vendor breaches and rating drops; Track remediation commitments to closure. Hands over Monitoring Setup and Reassessment Calendar. Phase 6, Reporting and Governance. We give you reporting that satisfies your own auditors and feeds your wider compliance programme. Activities: Build the vendor risk dashboard for leadership; Map TPRM evidence to ISO 27001 and SOC 2 controls; Set governance forums and review cadence; Prepare audit-ready reporting packs. Hands over TPRM Governance Pack and Reporting Dashboard. Each phase begins from the artefact the phase before it produced.