Third Party Risk

The register is priced on the portfolio you actively manage, and the cap keeps the work honest: every vendor gets a record, a tier and a review cycle. Beyond the cap, additional vendors bill flat at US$500 each, falling to US$400 at the top tier, so the list can grow without renegotiating.

Most vendor failures are survivable; a few are not, and they are never the same vendors. A short onboarding questionnaire scores each vendor's inherent risk, and the tier drives how deep the assessment goes and how often it repeats, so effort lands where failure would actually hurt.

Nobody should rebuild the same questionnaire from scratch. A baseline third-party security questionnaire ships in full and abbreviated forms, the builder makes your own on the same engine, and every question maps to the control spine, so answers justify coverage later instead of sitting in a silo.

Vendors owe you answers, not membership of your platform. Each questionnaire goes out as an expiring link to a branded response page where the vendor answers, uploads evidence and submits, with every view and submission audited, so participation is easy and the trail is complete.

Reviewer attention is the scarce resource. On arrival, weak answers are flagged, follow-up questions drafted and a residual-risk change proposed, and your reviewer accepts or rejects each suggestion, so the judgement stays human while the reading is done for you.

An expired certificate on a critical vendor is an audit finding waiting to be written. Certificates and attestations sit in a register per vendor with their evidence, alerts land at 90, 30 and zero days, and a lapse on a high-tier vendor reopens the assessment by itself.

A second tracker is where vendor findings go to be forgotten. Weak answers and reviewer findings become tickets with owners and due dates on the workflow board your team already works, and the vendor only ever sees portal follow-ups, never your internal queue.

The portfolio has a shape and spreadsheets never show it. Every vendor carries an inherent score at onboarding and a residual score after assessment, and the heatmap plots one against the other by tier, so the relationships that still carry risk stand out at a glance.

Vendor risk that lives only in a TPRM tool never meets the register it belongs to. Themes like critical vendors operating without a current assessment promote into the risk register with their evidence attached, so third-party exposure is part of one picture.

The security officer's deliverable is the presentation, not the data. The report renders management-grade charts, coverage, expiry runway and remediation age, exports to PDF and XLSX, and takes a screenshot-clean shape that goes straight into a board pack.