TPRM
Third-Party Risk Management — the discipline of assessing and monitoring your vendors.
TPRM programs establish inherent risk tiers, collect due diligence at onboarding (SOC 2 reports, insurance, security questionnaires), and monitor for changes over the vendor's lifecycle.
Mature TPRM programs continuously monitor rather than re-questionnaire annually.
Make the lifecycle explicit
Third-party risk management starts before purchase and continues through onboarding, operation, renewal, and exit. Each stage has different decisions: whether to approve a relationship, what access to permit, what changes to investigate, and how to recover information when the service ends. Assign ownership for each decision.
Use proportionate due diligence
Tier vendors by sensitive data, privileged access, operational dependence, and contractual requirements. Request evidence that addresses those exposures rather than sending every supplier the same lengthy questionnaire. Document exceptions and accepted risks with an owner so an incomplete review is not mistaken for an unconditional approval.
Monitor decisions as well as signals
A useful program connects new information to an action: review an incident notice, reduce access, request evidence, or reconsider a renewal. Monitoring is not necessarily real-time and cannot prove that no issues exist. Define the sources, review cadence, escalation conditions, and records that show how the business responds.
Related terms
See how Scarlet Risk covers TPRM.
One platform for compliance, cyber, vendor, and world-watch risk.
Schedule Live Demo