Third-Party Risk Management
What we do → Risk & Compliance
Third-Party Risk Management
End-to-end vendor risk lifecycle — due diligence, onboarding, continuous monitoring, and remediation.
We design and operate third-party risk programs that stand up to regulator scrutiny — not spreadsheet-based vendor registers.
What we cover
- Vendor inventory and risk tiering
- Due diligence questionnaires and independent assurance evidence review
- Contractual right-to-audit, exit, and data-handling clauses
- Continuous monitoring with threat intelligence integration
- Fourth-party and AI vendor risk — the subcontractor your vendor uses
What you receive
A tiered vendor register, a repeatable due diligence process, and board-ready third-party risk reporting.
Our approach
Vendor risk is treated as a lifecycle: onboarding assessment, contractual safeguards, continuous monitoring, incident response, and offboarding. We risk-tier the vendor population first, then design the depth of due diligence to match the tier. Low-risk vendors get a self-attestation; critical vendors get an on-site assessment with technical artefact review.
Typical engagement
- Phase 1. Vendor inventory and tiering (2 weeks)
- Phase 2. Due diligence framework design (2 weeks)
- Phase 3. High-risk vendor assessments (4–8 weeks)
- Phase 4. Monitoring platform setup and operationalization
Related practices
