Frequently Asked Questions

What are the 5 phases of third-party risk management?

1. Planning and Risk Assessment

  • Identify the need for a third party (vendor, supplier, partner).

  • Define the scope of services they will provide.

  • Assess the inherent risk level (e.g., access to data, critical services, regulatory impact).

  • Decide the level of due diligence required.

2. Due Diligence and Vendor Selection

  • Evaluate the third party before onboarding.

  • Review:

    • Financial stability

    • Security controls

    • Compliance certifications (e.g., ISO 27001, SOC 2)

    • Reputation and past incidents

  • Choose the vendor that meets risk and business requirements.

3. Contracting and Onboarding

  • Create and sign contracts that include:

    • Security requirements

    • Data protection clauses

    • Service Level Agreements (SLAs)

    • Compliance obligations

    • Right to audit

  • Formally onboard the vendor into your systems and processes.

4. Ongoing Monitoring and Risk Management

  • Continuously monitor the vendor’s performance and risk.

  • Activities include:

    • Security reviews

    • Performance monitoring

    • Compliance checks

    • Reviewing audit reports

  • Address any emerging risks or issues.

5. Termination and Offboarding

  • Safely end the relationship when the contract expires or is terminated.

  • Ensure:

    • Return or destruction of company data

    • Removal of access rights

    • Secure disengagement

  • Conduct a final risk review.