Third-party risk management starts with the service you rely on and the consequences if it goes wrong. Use this guide to decide which relationships need attention, what evidence changes a decision, and how to follow through without building a process larger than the risk.
Start with the decision you need to make
- What Does Third-Party Risk Management Cover Beyond Reviewing a Vendor?
- Which Vendors Need the Most Oversight?
- What Should We Ask a Vendor About Its Fourth-Party Dependencies?
- Can We Manage Third-Party Risk Without Dedicated Software?
- When Do Third-Party Risk Tools Actually Help?
Questions worth asking
Can the service recover when you need it? Who handles your information or has important access? Could several vendors depend on the same underlying provider? What would you do if a provider introduced AI into a product you already use? These questions connect a review to the way your organization actually depends on the service.
Use evidence to resolve uncertainty
SOC reports, questionnaires, contract terms and other information can help. Select evidence that addresses the particular service and concern. A report or completed form is useful when it helps someone make, support or revisit a decision.
Keep the method proportionate
A shared register and assigned follow-ups may suit one team; a dedicated platform may help another. In either case, keep the owner, decision, unresolved issues and change triggers visible. Consider security alongside operational, financial, customer and other risks relevant to the relationship.
Quick answers
- What is fourth-party risk?
- Should we ask vendors how they manage their own third parties?
- Do we need a list of every supplier our vendor uses?
- Can different vendors still leave us dependent on the same provider?
- What should we track if we manage third-party risk manually?
- What work should a third-party risk tool help us do?
- How much review does a low-risk vendor need?
- What should happen after we approve a vendor?
- How can we spot AI being added to a product we already use?
- What should we reassess before enabling AI in an existing product?
