Financial Services · Moraph software

Vendor Risk Management (VRM)

Third-party due diligence your examiners can follow from start to finish

Book a demonstrationRequest a technical briefingFactsheet

Overview

What you are buying

Vendor Risk Management keeps your third-party inventory, risk tiers, due-diligence documents and reviews in one place. It requests SOC reports, insurance certificates and questionnaires from vendors, tracks what expires and when, and records each review, finding and follow-up so management, the board and examiners can see how every relationship is overseen.

The problem it solves

Regulators expect banks and credit unions to manage the risk of every third party across its whole life: before the contract, while it runs and when it ends. In many institutions that evidence is spread across spreadsheets, shared drives and email, so it is hard to show an examiner what was reviewed, by whom and what happened next.

  • The vendor list in accounts payable rarely matches the list the risk team is overseeing.
  • SOC reports and insurance certificates arrive by email, are filed inconsistently and expire unnoticed.
  • Exceptions in a vendor's SOC report and the controls your institution must operate itself are not tracked to an owner.
  • Board and examiner reports are assembled by hand each time they are requested.

Who uses it

  • Third-party risk managers who run the oversight program
  • Procurement and vendor managers who own each relationship day to day
  • Information security, privacy and business continuity reviewers
  • Compliance and internal audit teams
  • Boards and risk committees that oversee third-party risk

Requirements it supports

Interagency Guidance on Third-Party Relationships: Risk ManagementNCUA guidance on evaluating third-party relationshipsFFIEC IT Examination Handbook (Outsourcing Technology Services)FFIEC Business Continuity Management bookletGramm-Leach-Bliley Act safeguards for customer information

The product supports these requirements; meeting them remains your organization’s responsibility.

See how it works

A short walkthrough

Illustrative screens with fictional sample data. They show the workflow, not any client’s data or configuration, and the layout of the product itself differs. A live demonstration uses the product with sample data.

  1. Step 1

    The vendor inventory

    Every third party with its tier, owner and the state of its due diligence.

    VendorServiceTierNext reviewDocumentsOpen issues
    Example Core ProcessorCore bankingCriticalDue this monthSOC 1, SOC 2, COI1
    Example Card ServicesCard processingCriticalIn 3 monthsSOC 2, COI0
    Example Cloud BackupBackup and recoveryHighIn 5 monthsSOC 2 expired2
    Example Print & MailStatementsModerateIn 8 monthsQuestionnaire0
    Example Office SuppliesSuppliesLowNot requiredW-90
    Every third party with its tier, owner and the state of its due diligence.

  2. Step 2

    Setting the tier

    The relationship owner answers inherent-risk questions, and the answers set the tier and what due diligence follows.

    Inherent-risk questionnaire

    Customer or employee data
    Yes, employee personal information
    Supports a critical activity
    Yes, payroll
    Access to your systems
    File transfer only
    Customer-facing
    No
    Resulting tier
    High

    Due diligence required for this tier

    • SOC 2 Type II report
    • Certificate of insurance
    • Security questionnaire
    • Business continuity summary
    The relationship owner answers inherent-risk questions, and the answers set the tier and what due diligence follows.

  3. Step 3

    Requesting documents

    Requests go out by secure link, and each item is tracked until it arrives.

    ItemRequestedStatusReminders
    SOC 2 Type II reportFictional dateReceived0
    Certificate of insuranceFictional dateReceived1
    Security questionnaireFictional dateOverdue3, escalated to owner
    Business continuity summaryFictional dateRequested1
    Requests go out by secure link, and each item is tracked until it arrives.

  4. Step 4

    A SOC 2 review

    Reviewers record what the report covers, what it found, and which controls your institution must operate itself.

    SOC 2 Type II review

    Report period
    Fictional sample period
    Opinion
    Qualified
    Exceptions
    2, both in change management
    Subservice organizations
    1 (carved out)
    Bridge letter
    Requested

    Complementary user-entity controls

    • Review user access to the backup console: IT security
    • Approve restore requests: IT operations
    • Monitor backup job failures: IT operations
    Reviewers record what the report covers, what it found, and which controls your institution must operate itself.

  5. Step 5

    Following an issue to closure

    Findings become issues with an owner, and each step to closure is recorded.

    Change-management exceptions · Example Cloud Backup

    1. Issue raised from SOC 2 reviewSpecialist reviewer
    2. Vendor asked for remediation planThird-party risk manager
    3. Remediation plan received and attachedVendor contact
    4. Compensating control confirmedControl owner
    5. Closed with evidenceThird-party risk manager
    Findings become issues with an owner, and each step to closure is recorded.

  6. Step 6

    What needs attention

    Expiring documents, overdue reassessments and open issues, by owner.

    This month

    1. Certificate of insurance expires · Example Card ServicesRelationship owner
    2. SOC 2 report out of date · Example Cloud BackupThird-party risk
    3. Annual reassessment due · Example Core ProcessorThird-party risk
    4. Contract renewal-notice date · Example Print & MailProcurement
    5. Issue due: change-management exceptions follow-upIT security
    Expiring documents, overdue reassessments and open issues, by owner.

Workflows

The principal workflows

  1. Inventory and tiering

    Every third party recorded once, with its owner, the services it provides and a risk tier from an inherent-risk questionnaire, so effort goes where risk is highest.

    • Import vendors from your accounts-payable or procurement system, or add them as new relationships are proposed
    • The relationship owner answers inherent-risk questions about data access, criticality, customer impact and regulatory exposure
    • The answers set a risk tier and the due diligence and review frequency that tier requires
    • Relationships that support critical activities are flagged for heightened oversight and contingency planning
    • Vendors with no current relationship are retired from the inventory with a recorded reason

  2. Due diligence

    Requests for documents and questionnaires go to the vendor through a secure upload link. Responses are attached to the vendor's record as they arrive.

    • The tier decides which documents and questionnaires are requested
    • Vendors receive a secure link and upload documents without needing an account
    • Reminders are sent until each item arrives, and overdue requests are escalated to the relationship owner
    • Each document is recorded with its type, date and period covered
    • Missing or declined items are noted on the record so the gap is visible

  3. Review

    Reviewers record the scope, period and exceptions of SOC reports and map complementary user-entity controls to the people at your institution who own them.

    • Reviews are assigned to security, privacy, continuity, legal or finance reviewers according to the tier
    • SOC reports are reviewed on a structured template covering scope, period, opinion, exceptions and subservice organizations
    • Complementary user-entity controls are assigned to owners at your institution
    • Findings become issues with an owner and due date
    • The relationship owner records a conclusion, and the review is approved and locked

  4. Monitor and report

    Expiring certificates and reports, reassessments due by tier, and open issues are tracked, and summarized for management, the board and examiners.

    • Dates on documents and contracts drive reminders before anything lapses
    • Reassessments are scheduled automatically according to tier
    • Open issues are followed until they are closed with evidence
    • Contract renewal-notice dates prompt a decision to renew, renegotiate or exit
    • Summary reports are produced for management, committees and examination requests

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Third-party risk manager

Third-party risk manager, vendor management officer, head of vendor management

Runs the third-party risk program: sets how vendors are tiered and reviewed, keeps the work moving, and reports on the program to management, the board and examiners.

Sees

  • Every vendor in the inventory, with its tier, owner and due-diligence status
  • All reviews, findings, issues and their history
  • Expiry dates, overdue reassessments and open requests across the program
  • Program reports and the audit trail

Does

  • Configures risk tiers, inherent-risk questions and the questionnaire library
  • Assigns reviews to relationship owners and specialist reviewers
  • Sends and chases document requests to vendors
  • Approves tier changes and the conclusion of reviews for critical vendors
  • Closes issues once remediation is evidenced
  • Prepares committee, board and examiner reports

Cannot

  • Change or delete a completed review; corrections are added as a new, linked entry
  • Grant themselves additional permissions; role changes are made by an administrator and recorded
Approvals
Approves tier changes, review conclusions for critical vendors and issue closures.
Notified about
When a review is submitted for approval, a critical vendor's document expires, or a reassessment becomes overdue.

Relationship owner

Business-line manager, department head, contract owner

The person at your institution accountable for a vendor relationship and the service it provides.

Sees

  • The vendors they own, with tier, documents, reviews and open issues
  • Contract terms, renewal-notice and termination dates for those vendors
  • Requests and reminders sent to their vendors

Does

  • Proposes new vendors and answers the inherent-risk questions
  • Flags whether a vendor supports a critical activity
  • Records the conclusion of each review for their vendors
  • Owns issues raised against their vendors and records remediation
  • Keeps the exit plan current for critical vendors

Cannot

  • See vendors owned by other people unless shared with them
  • Approve their own tier change or the review of a critical vendor they own
  • Edit the questionnaire library or tiering rules
Approvals
Submits tiering and review conclusions for approval by the third-party risk manager.
Notified about
When a vendor they own has a document expiring, a review due, a finding raised or a renewal-notice date approaching.

Specialist reviewer

Information security analyst, privacy officer, business continuity manager, counsel, finance analyst

Assesses the evidence in their area of expertise and records findings.

Sees

  • The reviews assigned to them and the vendor documents those reviews need
  • Previous reviews and findings for the same vendor in their area
  • The questionnaire answers relevant to their area

Does

  • Completes SOC report reviews: scope, period, opinion, exceptions and subservice organizations
  • Maps complementary user-entity controls to control owners
  • Raises findings with a severity and a recommended action
  • Requests further information or a bridge letter from the vendor
  • Signs off their part of the review

Cannot

  • Change a vendor's tier or close the review as a whole
  • Close issues they raised; closure needs the third-party risk manager
Approvals
Their sign-off is required before a review in their area can be concluded.
Notified about
When a review is assigned to them, new evidence arrives for it, or the vendor answers a question they raised.

Control owner

IT operations manager, access administrator, application owner

Operates the controls your institution must run itself for a vendor's controls to be effective.

Sees

  • The complementary user-entity controls assigned to them and the vendor each relates to
  • The relevant excerpt of the vendor's report
  • The history of their acknowledgements

Does

  • Acknowledges each control assigned to them
  • Records how the control is operated and attaches evidence
  • Raises a concern if a control cannot be operated as described

Cannot

  • See the rest of the vendor's documents or reviews unless shared
  • Change control assignments
Approvals
None; acknowledgements are recorded against the review.
Notified about
When a control is assigned to them or a periodic re-acknowledgement is due.

Auditor or examiner (read-only)

Internal auditor, external auditor, examiner given temporary access

Tests and evaluates the program without being able to change it.

Sees

  • The inventory, tiers, reviews, findings, issues and reports in the scope you grant
  • The audit trail of who did what and when
  • Configuration history: tier rules and questionnaire versions

Does

  • Searches and filters the inventory and reviews
  • Exports reports and evidence for their work papers
  • Samples reviews and follows each back to its evidence

Cannot

  • Create, edit or delete anything
  • Contact vendors through the product
Approvals
None.
Notified about
Not notified by default; access ends on the date set when it is granted.

Vendor contact (external)

The vendor's account manager, security or compliance contact

Provides the documents and answers your institution asks for.

Sees

  • Only the requests sent to them, with what is needed and by when
  • The documents they have uploaded for those requests

Does

  • Uploads requested documents such as SOC reports, insurance certificates and financial statements
  • Answers questionnaires and follow-up questions
  • Asks for clarification on a request

Cannot

  • See your reviews, findings, tier, other vendors or other requests
  • Change or withdraw a document after it has been accepted; a newer version is uploaded instead
Approvals
None.
Notified about
When a request is sent, as its due date approaches, and when a reviewer asks a follow-up question.

Administrator

Application administrator in your IT or GRC team

Manages users, roles and the product's settings.

Sees

  • Users, their roles and access history
  • Settings, integrations and notification rules
  • The audit trail of configuration and permission changes

Does

  • Adds and removes users and assigns roles
  • Configures single sign-on group mappings
  • Manages integrations such as the vendor-master import
  • Runs access reviews and exports user lists

Cannot

  • Conclude reviews or approve tier changes unless also given that role
  • Remove entries from the audit trail
Approvals
Role changes can be set to need a second administrator's approval.
Notified about
When an integration fails or a user's access is due for review.

Permissions at a glance

ActionTPRM managerRelationship ownerSpecialist reviewerControl ownerAuditorVendor contactAdmin
Add a vendor to the inventoryFullOwn work onlyNo accessNo accessNo accessNo accessNo access
Set or change a vendor's risk tierApprovesOwn work onlyNo accessNo accessView onlyNo accessNo access
Configure tiers and questionnairesFullNo accessNo accessNo accessView onlyNo accessNo access
Send document requests to a vendorFullOwn work onlyOwn work onlyNo accessNo accessNo accessNo access
Upload documents and answer questionnairesFullOwn work onlyNo accessNo accessNo accessOwn work onlyNo access
Complete a SOC report reviewFullView onlyOwn work onlyNo accessView onlyNo accessNo access
Conclude a reviewApprovesOwn work onlyNo accessNo accessView onlyNo accessNo access
Acknowledge user-entity controlsView onlyView onlyView onlyOwn work onlyView onlyNo accessNo access
Raise and update issuesFullOwn work onlyOwn work onlyOwn work onlyView onlyNo accessNo access
Close an issueApprovesNo accessNo accessNo accessView onlyNo accessNo access
Run and export program reportsFullOwn work onlyOwn work onlyNo accessView onlyNo accessNo access
Manage users and rolesNo accessNo accessNo accessNo accessNo accessNo accessFull
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • Segregation of duties: the person who owns a vendor cannot approve their own tier change or the review of a critical vendor, and the person who raised an issue cannot close it.
  • Roles are configured to match your organization during implementation, and can be mapped to groups in your identity provider so access follows people's jobs.
  • Every change to a user's role or permissions is recorded in the audit trail, and administrators can export user lists for periodic access reviews.
  • Vendor contacts and examiners are external users: vendors reach only their own requests through a secure link, and examiner access is read-only, limited to the scope you grant and ends on a set date.

Features

What it does

Single vendor inventory

One record per third party, with services, owners, contracts, documents, reviews and issues together.

Risk tiering

Configurable inherent-risk questions decide each vendor's tier and how often it is reassessed.

Critical activity flags

Relationships that support critical activities are marked for heightened oversight and contingency planning.

Vendor document requests

Ask for SOC reports, certificates of insurance, financial statements, policies and questionnaires, and chase them automatically.

Questionnaire library

Security, privacy, continuity and financial questionnaires you can adapt, with answers kept against the vendor.

SOC report reviews

A structured review template covering scope, period, opinion, exceptions, subservice organizations and complementary user-entity controls.

Bridge letter tracking

Gaps between a SOC report's period and today are recorded, with bridge letters requested and stored.

Expiry tracking

Insurance certificates, reports and contracts tracked against their dates, with reminders to the relationship owner.

Issues and remediation

Findings from reviews become issues with owners and due dates, kept until closed with evidence.

Contract terms

Term, renewal-notice and termination dates, and key rights such as audit and data return, recorded against the vendor.

Exit planning

For critical relationships, the exit and contingency plan is recorded and reviewed with the vendor's other evidence.

Board and exam reporting

Inventory by tier, overdue reviews and open issues, ready for committee packs and examiner requests.

Integrations

How it connects to your systems

Connects toHowWhat flows
Vendor masterVendors imported from your accounts-payable or procurement system by scheduled file or API, so the inventory is complete.In: vendor names, identifiers and spend
Contract repositoryContract dates and key terms recorded against the vendor, with links back to the signed agreement where it is stored.In: contract metadata and links
EmailRequests and reminders sent to vendors and owners by email, each with a link back to the task.Out: notifications only
Single sign-onStaff sign in through your identity provider using SAML or OpenID Connect. Vendors use a secure link and need no account.In: identity and group membership
GRC and risk toolsIssues and vendor risk ratings shared with your governance, risk and compliance platform through the Work API.Out: tiers, issues and review outcomes
Rating servicesReports from security or financial rating services you subscribe to can be imported or attached to the vendor's record.In: reports as documents
Reporting toolsInventory, review and issue data available to your data warehouse and business intelligence tools.Out: program data through the Work API

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Single sign-on

Staff authenticate through your identity provider, so your own access policies and multi-factor requirements apply.

Role-based access

What each person can see and change follows their role, and sensitive documents can be limited to named reviewers.

Vendor links

Upload links are specific to one request and one vendor, and give no access to other vendors or your records.

Encryption

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization, as described in our Trust Center.

Audit trail

Every change to a vendor, document, review or issue is recorded with who made it and when.

Company-wide assurance

The product runs under the same controls as the rest of Moraph, which are independently audited to SOC 2 Type II and ISO/IEC 27001.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

12 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Inventory and risk

Third-party inventory

For third-party risk manager, relationship owners, internal audit

Every third party with its services, relationship owner, risk tier, critical-activity flag and the state of its due diligence.

Break down by
Risk tier, Service type, Relationship owner, Business unit, Critical activity
Delivered as
On screen, CSV or spreadsheet export, and the Work API
Used for
Answering the first question in any exam or audit: who are your third parties, and which matter most.

Inherent risk and tiering

For third-party risk manager, risk committee

The inherent-risk answers behind each vendor's tier, changes of tier and the reasons recorded for them.

Break down by
Risk tier, Risk factor (data access, system access, customer impact), Business unit, Date of last tiering
Delivered as
On screen and export
Used for
Showing that tiering follows a consistent method, and spotting vendors whose tier no longer matches what they do.

Critical relationships

For senior management, board risk committee

Vendors supporting critical activities, their latest review outcome, open issues, contract notice dates and the status of their contingency and exit plans.

Break down by
Critical activity supported, Relationship owner, Contingency plan status, Exit plan status
Delivered as
On screen, PDF for committee packs, export
Used for
Board-level oversight of the relationships where a failure would hurt customers or operations.

Due diligence and monitoring

Reviews due and overdue

For third-party risk manager, relationship owners

Initial and periodic reviews that are due, in progress or overdue, against the schedule each tier sets.

Break down by
Risk tier, Relationship owner, Review stage, Reviewer
Delivered as
On screen, scheduled email digest, export
Used for
Keeping the reassessment program on schedule and following up the owners who are behind.

Outstanding document requests

For third-party risk manager, relationship owners

Requests sent to vendors for SOC reports, insurance certificates, financial statements and questionnaires, with who has responded and who has not.

Break down by
Vendor, Document type, Request date, Reminders sent
Delivered as
On screen and scheduled email digest
Used for
Chasing unresponsive vendors and knowing which reviews are waiting on the vendor rather than on your team.

Expiring documents and contract dates

For relationship owners, procurement, legal

Insurance certificates, SOC reports, bridge letters and contracts approaching expiry, plus renewal-notice and termination dates.

Break down by
Document or date type, Vendor, Relationship owner, Month
Delivered as
On screen, calendar view, scheduled email digest, export
Used for
Acting before a certificate lapses or a renewal notice window closes.

SOC report review summary

For information security, specialist reviewers, internal audit

Each SOC report reviewed, its period and opinion, exceptions noted, subservice organizations, and bridge-letter coverage of any gap.

Break down by
Opinion type, Report type (SOC 1, SOC 2), Exceptions recorded, Reviewer
Delivered as
On screen and export
Used for
Demonstrating that reports were actually read, not just collected.

Issues and controls

Open issues and remediation

For third-party risk manager, relationship owners, risk committee

Issues raised from reviews, with severity, owner, agreed remediation, due date and status.

Break down by
Severity, Owner, Vendor, Age, Source review
Delivered as
On screen, scheduled email digest, export
Used for
Tracking findings to closure and showing management which vendors carry unresolved risk.

Complementary user-entity controls

For control owners, information security, internal audit

Controls your institution must operate for each vendor's SOC report to hold, mapped to their internal owners, with confirmation status.

Break down by
Vendor, Control owner, Confirmation status, Report period
Delivered as
On screen and export
Used for
Closing the gap auditors look for: the vendor's controls rely on yours, and yours need an owner.

Oversight and examinations

Committee and board pack

For board and risk committee, senior management

A consistent summary of the inventory by tier, critical relationships, reviews completed and overdue, open issues and new or terminated relationships since the last pack.

Break down by
Period, Risk tier, Business unit
Delivered as
PDF and editable export, produced on demand or on a schedule
Used for
The same format every meeting, so trends are visible and the pack comes from the system of record instead of manual collation.

Examination request pack

For third-party risk manager, examiners, internal and external auditors

For the vendors an examiner selects: the inventory record, tiering rationale, due-diligence documents, reviews, issues and their history.

Break down by
Vendor, Review period, Document type
Delivered as
Bundled export, or read-only access for named examiners
Used for
Answering exam and audit requests from the system of record instead of searching shared drives and email.

Program activity and audit trail

For third-party risk manager, internal audit

Who reviewed, approved, changed or exported what, and when, across vendors, reviews, issues and permissions.

Break down by
User, Action, Vendor, Date range
Delivered as
On screen and export
Used for
Evidence that the program operated as designed throughout the period under review.

Exports, access and evidence

  • Every report can be exported to CSV or spreadsheet, and the committee and examination packs to PDF. Reports can be scheduled as an email digest to the people who need them, with links back to the records rather than attachments containing vendor documents.
  • Teams can save their own filtered views and build reports from the inventory, review, issue and document fields, without asking Moraph to change the product.
  • The same data is available through the Moraph Work API, so you can feed your GRC platform, data warehouse or business intelligence tools such as Power BI or Tableau.
  • Reports respect roles: relationship owners see their own vendors, examiners and auditors get read-only access to what they have been given, and vendor contacts never see reports at all.
  • Reports can be run as of a past date, so a committee pack or exam response can be reproduced exactly as it stood. Every report run and export is recorded in the audit trail.

Deployment

Where and how it runs

Moraph cloud

Hosted by Moraph in the United States, United Kingdom or Australia region.

Dedicated environment

Single-tenant hosting where your policies require it, scoped in the proposal.

With a managed service

Optionally run alongside a Moraph managed service for platform administration and configuration changes.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Program design

We review your third-party risk policy with you and turn it into tiers, review requirements and approval steps.

Questionnaires

Inherent-risk and due-diligence questionnaires are configured from our library and your existing questions.

Inventory load

Vendors are imported from your vendor master and existing spreadsheets, de-duplicated and matched to owners.

Document migration

Current SOC reports, certificates and contracts are loaded against the right vendors, with their dates.

Integrations

Single sign-on, the vendor master feed and any reporting connections are set up and tested.

Training and handover

Risk managers, relationship owners and reviewers are trained on their part of the workflow, and your team takes over configuration.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • It organizes and evidences due diligence. The risk decisions are made by your reviewers.
  • It does not continuously scan vendors' internet-facing systems or financial health. Reports from rating services you subscribe to can be attached to the vendor's record.
  • Questionnaire content and tiering rules are set up with you during implementation and owned by your team afterwards.
  • It does not read SOC reports for you. Reviewers record the scope, exceptions and controls using the review template.
  • It is not a contract management system. It records key dates and terms and links to the agreement held elsewhere.
  • It does not manage purchasing, invoices or payments to vendors.
  • Vendors must respond to requests themselves. The product reminds and escalates but cannot obtain documents a vendor declines to provide.
  • Fourth parties are recorded as listed by your vendors; the product does not discover them independently.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. Show how a new vendor is tiered and how the tier changes the due diligence requested.
  2. Walk through a SOC 2 review, including exceptions and complementary user-entity controls.
  3. Show what a vendor sees when they receive a request, and what happens when they do not respond.
  4. Show how an issue from a review is followed to closure with evidence.
  5. Produce the reports a board committee and an examiner would ask for.
  6. Explain how our current spreadsheets and documents would be migrated.

Questions

Frequently asked questions

Do vendors need an account?

No. Each request reaches the vendor as a secure link for that request only, and they upload documents or answer questionnaires without signing in.

Can we use our own questionnaires?

Yes. Your existing questions are loaded during implementation, alongside or instead of the questionnaires in our library, and your team can change them afterwards.

How are tiers decided?

By rules you agree with us during implementation, based on answers to inherent-risk questions such as data access, criticality and customer impact. A risk manager can override a tier with a recorded reason.

Does it replace our contract management system?

No. It records the dates and terms that matter for oversight and links to the agreement wherever you keep it.

Can examiners see the program directly?

You can give an examiner or auditor a read-only role for the period of an examination, or produce reports and exports for them.

What happens to our records when a vendor relationship ends?

The vendor is retired, not deleted, so its history, reviews and exit steps remain available for as long as your retention policy requires.

Next steps

Evaluate Vendor Risk Management (VRM)

Book a demonstration

See the product working with sample data, focused on your workflows.

Request a demonstration

Request a technical briefing

Architecture, integrations, security and hosting, with our engineers and your technical team.

Request a briefing

Factsheet

This page on two sides, to share with colleagues or add to your evaluation file.

Open the factsheet

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: Vendor Risk Management (VRM) guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: Vendor Risk Management (VRM) support guide.

Related products