TPRM FAQ

Supplier risk questions?
Find a clear answer.

Understand what to check, which suppliers to prioritise and how to keep monitoring, actions and Board oversight working.

TPRM FAQ / 01

Framework & purpose

Why a clear, repeatable approach matters.

What is a supplier-risk framework?

It is a clear way to decide which suppliers need checking, what evidence to collect and who acts on the findings. Third-party risk management, or TPRM, helps you follow the same steps across the organisation. For financial firms, the aim is to protect customers, personal data and services such as payments or account access.

Why write the process down?

People change jobs and suppliers change over time. A written process helps a new colleague understand what to check, when to review it and who can make decisions. Keep it usable: clear steps, named owners and records that can be found. A long policy that nobody follows provides little practical help.

Which legal or regulatory duties apply?

That depends on the firm, service, data and location. UK GDPR sets duties when a supplier processes personal data for you. UK financial-sector rules can add requirements for outsourcing and resilience. EU DORA applies to financial entities within its scope. Identify the relevant duties first, then connect them to your checks, contracts and evidence. TPRM is not a single law for every supplier.

What evidence should we keep?

Keep a record of the supplier, service, owner, risk assessment, checks, contract terms and open actions. Show who approved important decisions and when the next review is due. Evidence should reflect what happened in practice. For example, a recovery test should record the result and follow-up, not simply say that a plan exists.

Trusted by organisations where security matters.

Supplier risk / 02

Know who you rely on.
Focus on the greatest risks.

Risk tiering means grouping suppliers by the harm their failure could cause. It helps you spend time on the checks that matter most.

How should we group suppliers by risk?

Use risk levels to decide how much checking each supplier needs. A simple model has three groups: critical, medium and lower risk. Judge the service, data access and possible harm to customers. The labels are a management tool, not a universal legal classification. A small supplier can still be critical if a key service depends on it.

How do we find all our suppliers?

Bring purchasing, finance, technology and service owners together. Compare contracts, payments and system access. Record what each supplier does, who owns the relationship and what data or services it supports. Include important suppliers used by your providers where these links could affect you. Keep one shared, maintained record.

Which existing suppliers should we check first?

Start where a failure could cause the greatest harm. For a financial firm, that may include payments, account access or storage of customer information. Review missing evidence and urgent issues first. Set a plan for the rest, with named owners and dates. A backlog should be visible and managed, not hidden behind a completed questionnaire.

What checks do lower-risk suppliers need?

Use proportionate checks and revisit the risk when the service changes. Cyber Essentials may be useful evidence, but it is not a universal legal requirement for every supplier. Your contracts, policies or sector rules may require specific standards. Confirm what applies and record why the level of checking is enough.

How quickly should a supplier recover?

Set the recovery time around the service and the harm that disruption could cause. There is no single recovery deadline for every supplier in a risk group. A recovery time objective is the target time for restoring a service. Check that the supplier’s target supports your own needs and that recovery has been tested.

Can we approve a supplier with unresolved issues?

Sometimes a named risk owner may accept a defined risk, within the firm’s rules and any legal limits. Record the issue, safeguards, deadline and review date. Conditional approval must not waive a legal duty or become permanent by default. If the risk is too high, fix it before use or choose another provider.

Why keep a shared supplier record?

It keeps key information available when people leave or change roles. An authorised colleague can see the contract, review date, open risks and owner. Keep records current and limit access to those who need it. A central list is only useful if people maintain it.

What should the purchasing team do?

Bring security and service owners into the decision before a contract is signed. Ask what the supplier will do, what it can access and how its failure could affect customers. Make sure required checks and contract terms are completed. Responsibility should be clear across purchasing, security, legal and the business owner.

Supplier risk / 03

Check the evidence.
Understand the risk.

Due diligence means checking a supplier before you rely on them, then keeping those checks up to date. Focus on what a failure could mean for your customers, data and services.

What checks should we make before using a supplier?

Match the checks to what could go wrong. A supplier running customer payments needs closer review than one providing office supplies. Check the service, data access, security evidence, recovery plans and contract terms. Give each gap an owner. An on-site audit may be useful, but it is not a universal legal requirement for every high-risk supplier.

How do we check more than a questionnaire?

Ask for evidence behind the answers. This may include recent test results, recovery exercises, audit findings and proof that problems were fixed. ISO 27001 is a certification for an information security management system. SOC 2 is an independent assurance report. Check what each covers, when it was assessed and any exceptions. Neither proves that every part of a supplier is safe.

Why does physical security matter?

People can also reach data through buildings, devices and storage. Check how the supplier controls access, protects equipment and handles lost devices. The depth of the review should reflect the service and the harm that a failure could cause. Physical security is one part of the wider assessment.

What does data integrity mean?

It means information stays accurate and complete. For a financial firm, an incorrect account balance or changed payment detail can harm customers. Check who can change records, how changes are recorded and how errors are found and corrected. Protecting data means more than keeping it private.

When is a data protection impact assessment required?

A data protection impact assessment, or DPIA, examines how planned use of personal data could harm people and how to reduce that harm. Under UK GDPR, one is required where processing is likely to create a high risk to people’s rights and freedoms. The test is not simply how much access a supplier has, or the possible fine for your business. Assess the proposed processing before it starts.

What are inherent and residual risk?

Inherent risk is the risk before safeguards are taken into account. Residual risk is what remains after those safeguards. For example, a supplier outage may still interrupt payments even with a tested backup plan. Reviewing a certificate does not itself remove that risk. A named owner should decide whether the remaining risk is acceptable and record any further action.

What is concentration risk?

It is the danger of depending too heavily on one provider, location or shared system. Several suppliers may all use the same cloud service. One outage could then affect them together. Map these links and check realistic alternatives, recovery arrangements and exit plans. Separate contracts do not always mean separate risks.

Can existing reports make checks quicker?

Yes. Current certificates and assurance reports can reduce repeated questions. Check their scope, findings and relevance to the service you are buying. Use them alongside the other evidence you need. Lower-risk suppliers may need a lighter review, but speed should not hide missing evidence or unresolved problems.

See the ICO guidance on when a DPIA is required.

TPRM FAQ / 04

Monitoring & lifecycle

Keep control as suppliers, services and risks change.

What should happen from the start to the end of a supplier contract?

Check the supplier before use, agree the terms and keep records current. Review changes to the service, access or risk. When the relationship ends, remove access and arrange the return or deletion of data as required. Plan how the service will continue during a change of provider.

How often should we review a supplier?

Set a review schedule based on the service, risk and applicable requirements. Also review after important events, such as an incident, new data access or a change of provider. Regular reviews and event-based checks work together. There is no single review frequency that suits every supplier.

What does continuous monitoring add?

It can flag changes between formal reviews, such as reported incidents or exposed systems. These signals need checking and context. A risk score alone does not prove that a supplier is safe or unsafe. Use monitoring alongside direct evidence, conversations and follow-up on agreed actions.

What is a fourth party?

It is a supplier used by your supplier. For example, your software provider may rely on a cloud platform. If that platform fails, your service may fail too. Identify the important links and understand how your provider manages them. Focus on dependencies that could affect your customers or critical services.

When should we reassess the risk?

Review when the service becomes more important, data moves to another location, access expands or a serious incident occurs. Changes in ownership or financial health can also matter. Decide what evidence needs updating and whether your existing safeguards remain suitable.

How should we prepare to leave a supplier?

Plan the handover, data return, access removal and alternative service before they become urgent. Check what the contract allows and whether the plan is realistic. Test important parts where appropriate. An exit plan can reduce disruption, but it does not guarantee a switch with no downtime.

TPRM FAQ / 05

Mitigation & response

Turn findings into clear actions and prepare for disruption.

What should happen when a gap is found?

Explain the risk and agree the action needed with the supplier. Set an owner and deadline. Check evidence that the fix has worked rather than closing an action because someone says it is complete. Give urgent issues a clear route to the people who can decide and act.

What if the supplier cannot fix it quickly?

Consider temporary safeguards, reduced access or an alternative service. Record the risk that remains and who can accept it within your rules and legal duties. Set a review date. If the risk is too high, the answer may be to delay use or change supplier. A response plan alone may not make an unsafe arrangement acceptable.

How do we prepare for a supplier incident?

Agree contacts, escalation routes and who makes key decisions. Plan how to keep customers informed and services running. Test a realistic scenario together where possible. Check any reporting duties that apply, including deadlines. Update the plan after exercises, incidents or major changes.

What if the problem sits with our supplier’s provider?

Work through your direct supplier to understand the dependency and the safeguards. Check contract terms for subcontracting, information, access and changes. The rights you have depend on the arrangement and relevant law. Include important downstream dependencies in recovery and exit planning, rather than assuming they are outside your responsibility.

Free practical guides

Know what to check.
Know what to do next.

Practical guidance to help you spot gaps, ask better questions and decide where to focus. Explore a guide to see what’s inside.

You can outsource the work, but you keep responsibilities.

If you decide why and how personal data is used, you are the controller. A supplier using it on your instructions is a processor. Under UK GDPR, the UK’s data protection rules, you must:

Choose a suitable provider. Assess whether it can protect people’s data and meet the rules.
Set the terms in writing. Cover instructions, security, other providers it uses, support with breaches and rights requests, data return or deletion, and audit rights.
Keep evidence. Show why the supplier is suitable and check that the arrangement stays appropriate.

TPRM is a way to manage risk, not one law for every supplier. Duties depend on the data, relationship and sector. Logica helps you turn these checks into practical work.

Get the free supplier risk guide

Plans, tests and evidence. Not just a policy.

For financial firms within its scope, DORA sets legal duties across technology risk, incident reporting, testing and supplier oversight. Your firm remains responsible when services are outsourced.

Prepare for disruption. Set responsibilities, protect important systems and test response and recovery.
Report major incidents. Follow the required process and deadlines for serious technology incidents.
Manage supplier risk. Keep a register of technology service contracts, assess risks and include required terms. Critical or important services need stronger checks and exit planning.

DORA is not a blanket UK rule. EU operations or supplying EU financial firms may bring duties or contract requirements. Logica helps you assess the gaps and plan the work.

Get the free DORA guide

TPRM FAQ / 06

Governance & reporting

Give leaders a clear view of supplier risk and ownership.

What should leaders see?

Show which suppliers support important services, the main risks and the actions still open. Explain the possible customer impact and any decision needed. Name the owner and the next review date. Leaders should be able to see where support, funding or a change of approach is required.

Which measures are useful?

Useful measures include overdue high-priority actions, missing evidence for critical services and the results of recovery tests. Explain what changed and why it matters. A large number of completed questionnaires can hide serious unresolved issues, so report the risk as well as the activity.

What does assurance mean in practice?

It means having evidence that gives a reasonable basis for confidence. That might include tests, independent reviews and verified fixes. Keep a clear record of decisions and limitations. Good records support oversight, but paperwork alone does not show that safeguards work.

Who should own a supplier risk?

Assign a named business owner, with support from security, risk, purchasing and legal teams as needed. Make clear who can approve a decision and who receives an urgent concern. Keep the process documented so it can continue when a colleague is absent or leaves.

Can weak reporting create regulatory problems?

Yes, where it means a firm cannot meet or demonstrate the duties that apply to it. The consequences depend on the rule, facts and regulator. Avoid treating a report as a shield. The priority is effective oversight, action on significant risks and evidence of the decisions made.

How do reports lead to improvements?

End each important issue with a decision or next step. Track the action, owner, due date and evidence of completion. Review delays and check whether the risk has reduced. This turns reporting into a way to manage the work, rather than a repeated description of the same problems.

Put these principles into practice with your team.

Speak to an expert Request a call back

Supplier risk questions?Find a clear answer.