Third-party risk management (TPRM) is how you check that a supplier is safe to rely on: what data and systems they touch, whether they have been screened, whether their certificates are in date and whether the risk left after your checks is acceptable. SupplierVault keeps this on each supplier record and pulls it together on the TPRM page as a live risk register.
Where to find it
- On a supplier: the Risk and compliance tab, section Third-party risk.
- Across all suppliers: TPRM in the Lifecycle menu.
The section applies to T1 and T2 suppliers by default. If you answered Yes to "Do suppliers access your systems or hold your customer or staff data?" in the setup questions, it applies to every tier. You can also switch the Third-party risk module on or off in Modules and forms.
The Third-party risk section on a supplier
| Field | What it means |
|---|---|
| Data access | "None of our data", "Internal / operational data" or "Customer data or workloads". |
| Access to our systems or sites | Tick if they log in to your systems, connect to your network or work on your premises. |
| Sanctions screened on | The date the supplier was last screened. |
| Screening result | "Not screened", "Clear" or "Potential match". |
| Last full assessment | The date of the last complete risk assessment. |
| Next due (N-month cycle) | Worked out from the last assessment and the cycle (see below). |
| Residual risk by area | Security, Financial, Data protection, and Geographic / concentration, each Not assessed, Low, Medium or High. |
The header shows two chips: Inherent and Residual ("—" if not assessed yet).
Inherent risk: how it is worked out
Inherent risk is how risky the supplier is before any checks or controls. SupplierVault works it out for you; you don't enter it.
Example: a T2 supplier (2) holding customer data (2) with system access (1) scores 5, so inherent risk is High.
Residual risk
Residual risk is what remains after your checks and controls, such as a security questionnaire, a data processing agreement and contract terms. It's the figure to act on.
Re-assessment cycle
A live supplier (Active or Under review) is overdue when its cycle is above 0 and it has never been assessed or the due date has passed. Overdue items appear in Needs attention as "live supplier never risk-assessed" or "risk re-assessment overdue by Nd"; due within 30 days shows as "due in Nd".
Run a re-assessment
- On the supplier, click Start re-assessment. Tasks are created and assigned: sanctions and entity re-screen (Legal, 5 days), refresh security questionnaire and evidence (Security, 14), financial health check (Finance, 14), privacy review (Privacy, 21), code of conduct re-attestation (Procurement, 21), concentration and continuity review (Procurement, 21) and risk sign-off and residual rating (Security, 28).
- Work through the tasks, updating the residual ratings and screening result as you go.
- Click Mark assessment complete today. The last full assessment becomes today and the toast tells you when the next one is due.
Certificates and documents
Under Certificates & documents, pick a type (SOC 2 Type II, ISO 27001, DPA signed, Sub-processor list, Insurance certificate, Pen test summary, Export-control classification), enter an expiry date and click Add document.
- Green "Expires …" when in date, amber within 45 days, red "Expired …" once past, grey "No expiry".
- The TPRM page also picks up certificate dates from onboarding forms: insurance expiries (public liability, employer's liability, professional indemnity), health and safety accreditation, Gas Safe, SIA, waste carrier, controls reports (ISAE 3402 / SOC 1), Cyber Essentials, ISO 27001 and SOC 2 period end, plus the Cyber Essentials expiry in the security questionnaire. Duplicates with the same name appear once.
- Certificates expiring within 45 days or expired appear in Needs attention.
Suppliers can upload their own certificates through the supplier portal.
The TPRM page
Four tiles at the top:
| Tile | What it counts |
|---|---|
| Re-assessments overdue | Live suppliers past their cycle or never assessed. |
| Due in 60 days | Live suppliers whose next assessment is due within 60 days. |
| High risk | Suppliers whose inherent or residual risk is High. |
| Open risk actions | Open third-party risk tasks, with the number overdue. |
Below is the Third-party risk register: one row per supplier with Tier, Status and why, Risk (inherent and residual), Data and access, Checks (sanctions, modern slavery and required forms), Certificates, Next review and Actions.
The traffic lights
| Colour | When |
|---|---|
| Red "Act now" | Possible sanctions match, automatic check matches waiting, a live supplier overdue or never assessed, a live supplier not screened, or an expired certificate. |
| Amber | Re-assessment due within 60 days, a certificate expiring within 45 days, high residual risk, or privacy, security, code of conduct or AI forms not yet approved. Shown as "Checks in progress" while onboarding, otherwise "Attention". |
| Green "In date" | Assessed, screened and in date. |
| Grey | "Exiting" (offboarding) or "Closed". |
The same light drives the Risk status on each supplier record.
Search, sort, edit and export
- Search by supplier, area, tier or manager. Order by Most urgent first (red, amber, green, then highest risk) or A to Z. Tick Include closed suppliers to see them.
- Edit in place lets you change residual ratings, data and system access, record a sanctions result, edit certificate dates, add a certificate and set the last assessed date without opening each record. Each change saves to the supplier and is noted in its activity. Recording "Potential match" creates a Legal review task due the next day.
- Download spreadsheet exports the register as a CSV. Print prints it.
- Below the table, Open risk actions lists findings, evidence requests and re-assessment steps.
Third-party risk assessment request form
The TPRM request onboarding form is completed by the business owner and approved by Security, and it blocks go-live. It is required when the intake says the supplier will have system access, handle personal data or be critical. It asks about owners and contacts, the service, five risk indicators (access to internal systems, confidential information, critical operations, intellectual property or source code, and developing software for you) and the service and cloud type. It shows how many risk indicators were answered yes.
Assurance and regulatory records
If you tick a profile under Settings → What you need to evidence, each supplier gets an Assurance and regulatory records section. SupplierVault records the evidence; it doesn't give legal or regulatory advice.
Information security (ISO 27001 or Cyber Essentials)
A checklist mapped to ISO 27001 controls A.5.19 to A.5.23: supplier risk assessed, security questionnaire reviewed, Cyber Essentials status known, security terms in the contract, sub-suppliers known and requirements flowed down, service reviewed on schedule, and cloud risk assessed with residual risk accepted. The header shows "N ISO gaps" or "ISO evidence complete". Use Accept the residual risk to record the manager who accepted it and when. The report "ISO 27001 supplier controls" lists live suppliers.
Cyber Essentials and SOC 2
The security questionnaire records SOC 2 Type II, ISO 27001, MFA, encryption, pen testing, Cyber Essentials level, certificate number and expiry, incident reporting time and sub-processors. The Technology compliance pack also has these dates.
FCA outsourcing (FCA or PRA regulated)
Records whether the arrangement is outsourcing, its classification (critical or important, material, not material), the important business services it supports, when the FCA was notified, data location, audit and termination rights, sub-outsourcing consent, how easy it is to replace, when the exit plan was last tested and the exit plan document. The "Outsourcing register (FCA)" report lists them. From 18 March 2027 some firms must also report material third-party arrangements to the FCA; check with your compliance lead whether that applies to you.
Related and connected parties (academy trusts, charities, housing associations)
Records whether the supplier is connected, who and how. For academy trusts it records donations, the DfE report date, DfE approval over £40,000 and the reference, and shows spend this financial year (to 31 August) and the largest single transaction. For charities and housing associations it records when it was declared to the board or trustees and who approved it. Purchase requests to a connected supplier are held until the connection is recorded.
Remediation
In the Performance scorecard section you can record an issue raised, a corrective action plan and service credits. An issue without a plan is flagged red in Needs attention.
Reports
- Risk register: tier, inherent, residual, last assessed, next due, sanctions and Cyber Essentials.
- Executive supplier report: T1 suppliers plus T2 suppliers with high residual risk, an overdue risk review, open escalations or an overdue contract review.
Which plan includes it
Third-party risk is included from the Professional plan. On Essentials the page shows what it does and how to upgrade; anything saved before is kept.
Good to know
- A T4 supplier with a 0-month cycle and no high inherent risk shows "Not assessed yet" on the record and "Never" on the TPRM page, even if you recorded an assessment date. That's because it has no scheduled next date.
- The "Certificates in date" evidence check only counts certificates added on the record, not form dates.
- Automatic UK sanctions and modern slavery checks are covered in Company and sanctions checks.