Third-Party Risk Management

You continuously validate a third party’s controls by writing down the state each critical control should be in, reading evidence of that state from sources you can check on a schedule set by risk, and reopening the assessment whenever the evidence or the relationship changes. This article sets out the evidence sources, an 8 step method, the events that should reopen an assessment and what to do when a supplier’s controls deteriorate after onboarding.

Questionnaire-based third-party risk management (TPRM) judges a supplier by what it says about its own controls, and evidence-based TPRM judges it by what can be checked. This article compares the two, shows what US and EU regulators expect, and sets out how to combine questionnaire answers with outside telemetry and control evidence.

This buyer’s guide sorts third-party risk management software into four kinds of product and gives six questions a regulated enterprise can put to any vendor in a demo.