The free TPRM guide
Use the guide to explore supplier risk beyond a questionnaire or certificate. Bring clearer questions about access, oversight and responsibility to your next review.
Use the free guide to explore risk tiers, due diligence, monitoring and Board reporting. Turn a supplier list into a programme you can manage.
The execution gap
A supplier review should help protect customers and keep services running. These are six common gaps to check, especially where financial firms rely on outside companies for technology or customer data.
Third-party risk management, or TPRM, means checking and managing the risks from companies you depend on. Start with a shared supplier list. Record the service, data access and owner. For a financial firm, include the providers behind payments, account access and customer communications. You cannot manage a dependency you have not identified.
Risk tiering means grouping suppliers by the harm their failure could cause. Use clear questions about customer impact, sensitive data and service disruption. A small contract can still support a critical service. Give higher-risk suppliers closer attention and explain why the chosen level of checking is suitable.
Due diligence means making checks before you rely on a supplier. Ask for evidence that fits the service, such as security reports, recovery tests and contract terms. Check the scope and age of certificates. Record gaps and required fixes. A completed form is a starting point, not proof that the risk is controlled.
A supplier can change its systems, owners or providers after the contract is signed. Agree regular reviews and triggers for an earlier check, such as a serious incident or new access to customer data. Keep open actions visible. The review should tell you whether the risk has changed and what to do next.
Show which suppliers support key services, what could go wrong and which gaps remain. Explain the customer impact in plain terms. Set out the decision needed, the owner and the next step. A short, clear view of the most important risks is more useful than a long list of scores without context.
Name the person responsible for each supplier relationship and each unresolved risk. Agree who can accept a risk, approve a contract or require a fix. For regulated firms, using an outside provider does not simply transfer away responsibility. Keep records that explain the checks, decisions and follow-up.
What you will learn
Build a practical operating model across the whole supplier relationship.
Start with a shared list of the companies your organisation relies on. Record what each supplies, who owns the relationship and whether it handles customer data or supports an important service. This gives teams a common starting point. A cloud platform or payment provider may appear in several departments, so bringing records together helps reveal dependencies that separate lists can miss.
Risk tiering means grouping suppliers by the harm their failure could cause. Look at the service, sensitive data, access to your systems and the effect on customers. Use that picture to decide how closely to check each supplier. Higher-risk relationships need stronger evidence and review. Explain the reasons for the rating so it guides a decision rather than becoming an unexplained score.
An assessment is useful only when its findings lead to action. Agree which weaknesses need fixing, who will do the work and what evidence will show the action is complete. Keep checking for changes, incidents and missed commitments. For a financial firm, focus on how those changes could affect customer services. Monitoring should help you decide when to intervene or reassess the relationship.
Reporting should explain which supplier risks matter, what is improving and where a decision is needed. Connect open issues to the services and customers they could affect. Keep records and evidence up to date. Regular reviews help leaders challenge assumptions, approve priorities and see whether actions are reducing risk. The aim is a clear account of the position, not simply a longer report.
Phase 01
Connect risk management with procurement and supplier onboarding.
Bring security and risk checks into the buying process before a supplier is selected. This leaves time to ask for evidence, compare options and agree changes before the contract is signed. Make the handover between procurement, security, risk and the service owner clear. Early checks help avoid late surprises, such as missing recovery arrangements or unclear responsibilities for protecting customer information.
Build a reliable supplier list and group providers by their potential impact. Consider what they do, the data they use and what would happen if the service stopped. A small contract can still support a vital customer service. Use the impact, not just the price, to decide the level of review. Record the reasons so teams can update the rating when the relationship changes.
An initial assessment checks whether a supplier is suitable for the service you need. Combine focused questions with evidence such as security reports, recovery tests and relevant contract terms. Check what the evidence covers and how current it is. A certificate for a different service may not answer your concern. Record the gaps, the decision and any conditions that need to be met before work starts.
Remediation means fixing a weakness. A useful plan states the issue, its likely impact, the action required and the person responsible on each side of the supplier relationship. Agree realistic deadlines and the evidence needed to confirm the fix. Track overdue actions and decide when unresolved risk needs senior attention. This keeps findings moving beyond the assessment report and into practical work.
Agree who owns supplier risk, who can approve a relationship and who can accept a risk that remains. Teams need clear routes for decisions and for raising concerns. Reports should show important dependencies, open actions and changes in the risk position. Leaders can then focus on customer impact and the decisions needed, rather than trying to interpret a collection of supplier scores.
Phase 02
Maintain accurate supplier risk profiles and respond to new information.
Monitoring means watching for changes that could affect the supplier relationship. Signals might include a security incident, service outage, financial difficulty or a change in how customer information is handled. Choose information that is relevant to the service and decide who will review it. Monitoring is useful when it triggers a check or action; a stream of alerts without ownership can leave the same risks unresolved.
A supplier that was suitable at the start may change over time. Review the relationship on an agreed schedule and after important changes, such as a serious incident or expanded access to data. Update the assessment using current evidence and track new findings through to action. The review should explain what has changed, whether the risk is still acceptable and what needs to happen next.
A supplier incident can quickly become your customer-service problem. Agree how the supplier will contact you, what information it will share and how both teams will coordinate the response. Plan for disruption to the services you depend on, including recovery and communication. After an incident, review what happened and follow through on improvements. Clear responsibilities help avoid delays when several organisations are involved.
Senior leaders need to understand which supplier failures could cause the most harm and which decisions need their attention. Reports should connect the risk to customers, data and service availability. Show progress, unresolved gaps and the options available. Include a named owner and a clear next step. This helps leaders challenge the position and direct resources where they are most needed.
Onboarding is bringing a supplier into the organisation; offboarding is ending the relationship safely. Both stages need clear checks around access, information and responsibility. Before work starts, confirm the agreed safeguards. When the service ends, plan the handover, remove access and deal with data return or deletion as appropriate. The aim is to avoid gaps during change, when responsibilities can become unclear.
A fourth party is a supplier used by one of your own suppliers. For example, your software provider may depend on another company to host its systems. Understand the important dependencies behind the service and where several providers rely on the same organisation. This helps identify shared points of failure and informs recovery planning. Focus checks on the links that could affect your customers or important services.
Who it is for
Written for CISOs, security leaders and risk professionals who build, run or improve third-party risk management.
If supplier checks rely on one person or scattered records, work can stop when that person is unavailable. A repeatable process makes the programme easier to maintain. Start with clear steps, shared records and named owners. The guide helps frame the questions to ask about supplier checks, follow-up and reporting, so the approach can work consistently across teams.
Supplier relationships often involve procurement, the service owner, security, legal and risk teams. Without clear responsibilities, each team may assume someone else has checked a concern. Agree who gathers evidence, makes the decision and follows up on actions. Clear ownership helps issues move forward and gives staff a route for raising concerns before they affect customers or services.
Leaders need to know why a supplier risk matters and what action is being taken. A score or traffic-light colour is not enough without evidence and context. Bring together key dependencies, unresolved findings, owners and decisions needed. The guide supports a more useful conversation about supplier risk, helping teams explain the position clearly and identify where further evidence is needed.
Want to sense-check your current approach?
Free practical guides
Practical guidance to help you spot gaps, ask better questions and decide where to focus. Explore a guide to see what’s inside.
If you decide why and how personal data is used, you are the controller. A supplier using it on your instructions is a processor. Under UK GDPR, the UK’s data protection rules, you must:
TPRM is a way to manage risk, not one law for every supplier. Duties depend on the data, relationship and sector. Logica helps you turn these checks into practical work.
Get the free supplier risk guideFor financial firms within its scope, DORA sets legal duties across technology risk, incident reporting, testing and supplier oversight. Your firm remains responsible when services are outsourced.
DORA is not a blanket UK rule. EU operations or supplying EU financial firms may bring duties or contract requirements. Logica helps you assess the gaps and plan the work.
Get the free DORA guideGet the free guide
Request the Third-Party Risk Management guide using the form.
It is written to support decisions and practical delivery, across onboarding, monitoring, incident response and reporting.
Read our Privacy Policy ↗