Third-Party Risk Management
The methodology layer of vendor risk: how a real TPRM program is built, what it should catch, and how to tell a genuine practice from a checkbox exercise.
Third-party risk management (TPRM) is the discipline of identifying, assessing, and monitoring risk introduced by external vendors and suppliers before and during a business relationship. A real program tiers vendors by risk, runs due-diligence assessments (often via the SIG questionnaire), verifies findings against evidence, and monitors vendors on an ongoing basis rather than only at onboarding.
Real US search demand (Ahrefs): ~3,100 searches/mo for "third party risk management" · ~$13.00 CPC.
The buyer problem
Most organizations either have no formal third-party risk process (a spreadsheet and a gut check before signing a vendor contract) or have inherited a TPRM program that exists on paper but does not actually change a sourcing decision. Both leave the same exposure: a vendor with weak financial footing, a lapsed security posture, or no real business-continuity plan gets onboarded, and the risk surfaces only after an incident, an audit finding, or a regulator's question. Buyers coming to this guide are usually deciding whether to build the program in-house, bring in an advisory firm to design it, or adopt a methodology/software platform to run it - and need to know what "good" actually looks like before they can evaluate any of those options.
What a third-party risk management engagement covers
A TPRM engagement - whether delivered by an internal team, an advisory firm, or a platform vendor - covers the full third-party lifecycle: identifying and inventorying every vendor and supplier relationship, tiering each one by inherent risk (data access, financial exposure, operational criticality, regulatory scope), running a due-diligence assessment scaled to that tier, verifying self-reported answers against real evidence (SOC 2 reports, financial filings, insurance certificates, incident history), documenting residual risk and remediation requirements, and setting a monitoring cadence that continues for the life of the relationship, not just at signing.
Methods and techniques
- Vendor inventory and risk tiering (inherent risk scoring before any assessment work begins)
- Standardized due-diligence questionnaires, most commonly the Shared Assessments SIG (Standardized Information Gathering) questionnaire
- Evidence verification against self-reported answers (SOC 2 Type II reports, ISO 27001 certificates, financial statements, insurance certificates)
- Fourth-party mapping to understand a vendor's own critical subcontractors and concentration risk
- Contractual risk controls: right-to-audit clauses, breach-notification timelines, data-handling and subcontracting terms
- Ongoing monitoring: adverse-media screening, financial-health signals, security-posture rescoring, and periodic reassessment tied to risk tier
What to verify before you retain
- A real methodology, not a template. Ask the advisor or platform to walk through how they tier vendors and what specifically triggers a deeper assessment. A generic "we send a questionnaire" answer is a program that stops at data collection, not risk management.
- Evidence verification, not just collection. Confirm whether self-reported answers (a vendor claiming SOC 2 compliance, for example) are actually checked against the underlying report, or simply logged as-is. Unverified attestations are the single most common gap in weak TPRM programs.
- A monitoring cadence tied to risk tier. Onboarding-only assessment is not TPRM; it is a one-time gate. Ask what triggers a reassessment (contract renewal, a public breach at the vendor, a tier change) and how often high-risk vendors are revisited.
- Fourth-party awareness. Ask whether the methodology maps a vendor's own critical subcontractors. Concentration risk (many vendors relying on the same cloud region or subprocessor) is invisible without this step.
- Regulatory fit for your industry. Banking, healthcare, and other regulated sectors have named third-party risk expectations (OCC, FFIEC, HIPAA business-associate rules). Confirm the advisor or platform has real, demonstrable experience with your sector's specific guidance, not just general risk-consulting language.
Questions to put in your RFP
- Walk us through your vendor risk-tiering methodology. What inputs determine whether a vendor is high, medium, or low risk?
- How do you verify a vendor's self-reported compliance claims (SOC 2, ISO 27001, insurance) rather than simply recording them?
- What questionnaire or framework do you use for due diligence, and can you show a redacted example of a completed assessment?
- What is your standard reassessment cadence by risk tier, and what events trigger an off-cycle review?
- How do you handle fourth-party risk - do you map a vendor's own critical subcontractors?
- What does your remediation-tracking process look like when an assessment surfaces a real gap?
- Can you describe a real (anonymized) engagement where your assessment changed a sourcing decision or contract term?
Skip the cold search. Send this scope to us and we route it toward qualified third-party risk management advisors.
Request advisorsRed flags
- The engagement is described entirely in terms of "sending questionnaires" with no mention of evidence verification.
- No stated reassessment cadence - risk is assessed once at onboarding and never revisited.
- No ability to show a real (even redacted) sample assessment or deliverable.
- The firm or platform cannot explain how it would handle a vendor that refuses to provide requested evidence.
- Pricing or scope is vague about whether fourth-party/subcontractor risk is included at all.
- Marketing language leans on "AI-powered" risk scoring with no explanation of what data actually feeds the score.
Standards & frameworks referenced
Real, named standards bodies and frameworks relevant to this category. Listed for context; they do not endorse this index or any vendor. Verify any framework-alignment claim directly against the issuing body.
- SIG
- Shared Assessments Program. Publishes the Standardized Information Gathering (SIG) questionnaire, the de facto industry-standard TPRM due-diligence instrument, and the Vendor Risk Management Maturity Model (VRMMM).
- NIST
- National Institute of Standards and Technology. NIST SP 800-161 (Cybersecurity Supply Chain Risk Management Practices) is the primary US federal reference framework for third-party and supply-chain risk.
- ISO
- International Organization for Standardization. ISO/IEC 27036 addresses information security for supplier relationships; ISO 31000 provides the general risk-management framework many TPRM programs are built on.
- OCC
- Office of the Comptroller of the Currency. OCC Bulletin 2013-29 (updated by 2020-10 interagency guidance) sets third-party risk management expectations for national banks and federal savings associations.
Notable third-party risk management vendors
Real, publicly-documented vendors active in this category. Sourced and verified; not a ranking or endorsement.
Third-Party Risk Management: buyer FAQ
Is third-party risk management the same as vendor management?
No. Vendor management covers the full commercial relationship (contracts, performance, spend). TPRM is the risk-specific slice of that relationship: assessing and monitoring financial, security, operational, and compliance risk a vendor introduces. A vendor can be well-managed commercially and still be a significant unmanaged risk.
Do I need a TPRM program if I only have a handful of vendors?
Program formality should scale to risk exposure, not vendor count. A small company with one vendor holding sensitive customer data has more TPRM exposure than a larger company with fifty low-risk vendors. Tiering, not headcount, should drive how much process you build.
Should I build TPRM in-house or bring in an advisory firm?
It depends on scale, regulatory exposure, and internal risk expertise. See our in-house vs. outsourced comparison for the specific tradeoffs - the short version is that regulated industries and organizations with 50+ material vendor relationships usually get more value from outside methodology design, at least initially.
What is the difference between a TPRM framework and a TPRM assessment?
A framework is the overall structure - tiering rules, policies, escalation paths, monitoring cadence. An assessment is a single point-in-time evaluation of one vendor within that framework. You need the framework first; assessments without one become inconsistent and unauditable.