How to evaluate vendor and third-party risk management software

What this software does

Third-party risk management (TPRM) software keeps an inventory of an organization’s vendors and other third parties, rates the risk of each relationship, and runs the due diligence that follows from that rating. Typical functions include questionnaires sent to vendors, collection of documents such as SOC reports and insurance certificates, tracking of what expires and when, recording of each review and its findings, follow-up of issues to closure, and reports for management, the board and examiners.

A related category monitors vendors continuously from the outside, for example by rating the security of their internet-facing systems or tracking their financial health. Decide whether you are buying a system of record, a monitoring feed, or both.

The rules that shape the work

For US banks, the main reference is the Interagency Guidance on Third-Party Relationships: Risk Management, issued by the Federal Reserve, the FDIC and the OCC and final as of June 6, 2023. It replaced each agency’s earlier general guidance on the subject. Points that bear directly on software:

• Responsibility stays with the bank. The guidance states that using third parties does not diminish or remove a banking organization’s responsibility to ensure activities are performed safely and soundly and in compliance with applicable laws.
• A life cycle. It describes risk management across planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination, with governance through oversight and accountability, independent reviews, and documentation and reporting. A tool should support each stage, not only onboarding.
• Risk-based oversight. Relationships that support higher-risk activities, including critical activities, call for more comprehensive and rigorous oversight. Each organization identifies its own critical activities, so tiering rules must be yours to set.

Credit unions can refer to the NCUA’s Letter to Credit Unions 07-CU-13, Evaluating Third Party Relationships. For customer information, the Interagency Guidelines Establishing Information Security Standards under the Gramm-Leach-Bliley Act require due diligence in selecting service providers, contracts that require appropriate safeguards and, where your risk assessment indicates, monitoring that includes reviewing audits, summaries of test results or equivalent evaluations. The FFIEC IT Examination Handbook describes how examiners review technology service providers. Organizations outside banking have their own rules, such as business associate agreements under HIPAA, and should check them as well.

Who should be on the evaluation team

• The third-party risk manager, who will configure tiers and questionnaires and run program reporting.
• Relationship owners from the business, who will propose vendors and record the outcome of reviews. If the tool is hard for them, the inventory will fall behind.
• Procurement and contract staff, so that new vendors cannot bypass the process.
• Specialist reviewers for information security, privacy, business continuity, legal and financial condition.
• Compliance and internal audit, who will test the program and need to follow its evidence.
• A few real vendors, if you can arrange it, to try the questionnaire and upload experience from their side.

Questions to ask and things to test

• Tier a new vendor and see how the tier changes the due diligence requested. Can you change the tiering rules yourself, and is each change recorded?
• Mark a relationship as supporting a critical activity and see what changes: review depth, frequency, approvals and reporting.
• Walk through a SOC 2 review, including how exceptions are recorded and how complementary user entity controls are assigned to the people in your organization who must operate them.
• Look at the vendor’s side. What does a vendor contact see when they receive a request, and what happens when they do not respond?
• Follow an issue from a review to closure, with the evidence that it was resolved.
• Produce the reports a board committee and an examiner would ask for, from your own test data rather than a prepared demonstration.
• Ask about the full life cycle: contract key dates, renewals, exit plans and termination, not only onboarding.
• Ask how fourth parties are captured, meaning your vendors’ own critical subcontractors.
• Ask how your current spreadsheets and documents would be migrated, including expiry dates and past review conclusions.

Common limits to probe

• Decisions. Software organizes and evidences due diligence; the risk decisions are made by your reviewers. Be wary of a score presented as a conclusion.
• Document review. Some tools record the results of a SOC report review; others claim to extract them automatically. Either way, ask who checks the scope, the period covered and the exceptions.
• Outside-in monitoring. Ratings built from externally observable data do not replace questionnaires, document review or contract terms, and findings can be misattributed, for example on shared hosting. A good rating does not mean a vendor is secure.
• Contracts and purchasing. Many TPRM tools record key contract terms but are not contract management systems, and do not handle purchasing, invoices or payments.
• Vendor cooperation. A tool can remind and escalate, but it cannot obtain documents a vendor declines to provide.
• Fourth parties. Most tools record subcontractors as your vendors report them, rather than discovering them independently.
• Content ownership. Ask who maintains the questionnaires and tiering rules after go-live, and whether the vendor’s templates are licensed to you.

Implementation risks

• An incomplete inventory. The program covers only the vendors in the system. Reconcile the inventory with accounts payable and contract records before go-live, and again periodically.
• Tiering agreed too late. Agree the criteria for risk tiers and critical activities with the business and the board before configuration, or the tool will encode an argument that has not been settled.
• Questionnaire fatigue. Long, generic questionnaires slow vendors down and produce poor answers. Scale requests to the tier, and accept existing evidence such as SOC reports where it answers the question.
• Migration gaps. Expiry dates, open issues and past conclusions are easy to lose in a migration. Check a sample of records against the source after loading.
• A bypass route. If procurement can engage a vendor without going through the tool, the inventory will drift. Connect onboarding to the purchasing process.
• External users. Vendor contacts become users of your system. Review how they are invited, authenticated and removed, and what they can see.

Related reading on this site

Requirement pages: Interagency Guidance on Third-Party Relationships, Interagency Guidelines Establishing Information Security Standards, GLBA, FFIEC IT Examination Handbook and IT guidance.

In the glossary: Interagency guidance on third-party relationships, SOC 2, GLBA, FFIEC IT Examination Handbook.

This guide describes the category, not any one product. It is general information, not legal advice: for what a rule requires of your organization, read the rule itself or ask your counsel.