Glossary term
Third-Party Risk Management (TPRM)
Subject: Risk Management, Third-Party Risk
Also known as: Vendor risk management, Supplier risk management
Third-party risk management is the set of policies and processes a firm uses to identify, assess, contract with, monitor and exit external suppliers so that the risks they bring stay within acceptable limits.
Explanation
The work follows the life of each relationship. It starts with an inventory of suppliers and a tiering by importance. New suppliers go through due diligence and a risk assessment, often a questionnaire backed by evidence such as audit reports. Contracts then add the protections the firm needs: service levels, data and security terms, breach notice, subcontracting limits, a right to audit clause that lets the firm or its regulator inspect the supplier, and exit support. During the relationship the firm monitors performance, reviews risk periodically, and follows up issues. When data is handled for the firm by a processor, privacy law adds further duties. A named owner is accountable for each supplier. Regulators judge a firm by how it controls its suppliers, and weak oversight is a frequent finding.
Example
A health insurer ranks its 400 suppliers into four tiers. The 20 in the top tier get a full assessment before signing, an annual on-site review and a tested exit plan. Low-tier suppliers receive a short questionnaire every three years. When a top-tier claims processor misses its security audit, the insurer sets a deadline for fixes and escalates to the risk committee.
Not to be confused with
- Procurement
- Procurement selects and buys from suppliers on price and fit. TPRM assesses and controls the risks those suppliers create across the relationship.