Vendor Risk Management (VRM)

Principal workflows

• Inventory and tiering: Every third party recorded once, with its owner, the services it provides and a risk tier from an inherent-risk questionnaire, so effort goes where risk is highest.
• Due diligence: Requests for documents and questionnaires go to the vendor through a secure upload link. Responses are attached to the vendor's record as they arrive.
• Review: Reviewers record the scope, period and exceptions of SOC reports and map complementary user-entity controls to the people at your institution who own them.
• Monitor and report: Expiring certificates and reports, reassessments due by tier, and open issues are tracked, and summarized for management, the board and examiners.

Who uses it

• Third-party risk managers who run the oversight program
• Procurement and vendor managers who own each relationship day to day
• Information security, privacy and business continuity reviewers
• Compliance and internal audit teams
• Boards and risk committees that oversee third-party risk

Reporting

• Inventory by tier, service type and relationship owner
• Critical relationships and the status of their contingency plans
• Overdue reviews and outstanding document requests
• Expiring certificates, reports and contract notice dates
• Open issues by severity, owner and age
• Committee and examination packs in a consistent format

Features

• Single vendor inventory: One record per third party, with services, owners, contracts, documents, reviews and issues together.
• Risk tiering: Configurable inherent-risk questions decide each vendor's tier and how often it is reassessed.
• Critical activity flags: Relationships that support critical activities are marked for heightened oversight and contingency planning.
• Vendor document requests: Ask for SOC reports, certificates of insurance, financial statements, policies and questionnaires, and chase them automatically.
• Questionnaire library: Security, privacy, continuity and financial questionnaires you can adapt, with answers kept against the vendor.
• SOC report reviews: A structured review template covering scope, period, opinion, exceptions, subservice organizations and complementary user-entity controls.
• Bridge letter tracking: Gaps between a SOC report's period and today are recorded, with bridge letters requested and stored.
• Expiry tracking: Insurance certificates, reports and contracts tracked against their dates, with reminders to the relationship owner.
• Issues and remediation: Findings from reviews become issues with owners and due dates, kept until closed with evidence.
• Contract terms: Term, renewal-notice and termination dates, and key rights such as audit and data return, recorded against the vendor.
• Exit planning: For critical relationships, the exit and contingency plan is recorded and reviewed with the vendor's other evidence.
• Board and exam reporting: Inventory by tier, overdue reviews and open issues, ready for committee packs and examiner requests.

Integrations

• Vendor master: Vendors imported from your accounts-payable or procurement system by scheduled file or API, so the inventory is complete.
• Contract repository: Contract dates and key terms recorded against the vendor, with links back to the signed agreement where it is stored.
• Email: Requests and reminders sent to vendors and owners by email, each with a link back to the task.
• Single sign-on: Staff sign in through your identity provider using SAML or OpenID Connect. Vendors use a secure link and need no account.
• GRC and risk tools: Issues and vendor risk ratings shared with your governance, risk and compliance platform through the Work API.
• Rating services: Reports from security or financial rating services you subscribe to can be imported or attached to the vendor's record.
• Reporting tools: Inventory, review and issue data available to your data warehouse and business intelligence tools.

Deployment

• Moraph cloud: Hosted by Moraph in the United States, United Kingdom or Australia region.
• Dedicated environment: Single-tenant hosting where your policies require it, scoped in the proposal.
• With a managed service: Optionally run alongside a Moraph managed service for platform administration and configuration changes.

Security and privacy

• Single sign-on: Staff authenticate through your identity provider, so your own access policies and multi-factor requirements apply.
• Role-based access: What each person can see and change follows their role, and sensitive documents can be limited to named reviewers.
• Vendor links: Upload links are specific to one request and one vendor, and give no access to other vendors or your records.
• Encryption: Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization, as described in our Trust Center.
• Audit trail: Every change to a vendor, document, review or issue is recorded with who made it and when.
• Company-wide assurance: The product runs under the same controls as the rest of Moraph, which are independently audited to SOC 2 Type II and ISO/IEC 27001.

Limitations

• It organizes and evidences due diligence. The risk decisions are made by your reviewers.
• It does not continuously scan vendors' internet-facing systems or financial health. Reports from rating services you subscribe to can be attached to the vendor's record.
• Questionnaire content and tiering rules are set up with you during implementation and owned by your team afterwards.
• It does not read SOC reports for you. Reviewers record the scope, exceptions and controls using the review template.
• It is not a contract management system. It records key dates and terms and links to the agreement held elsewhere.
• It does not manage purchasing, invoices or payments to vendors.
• Vendors must respond to requests themselves. The product reminds and escalates but cannot obtain documents a vendor declines to provide.
• Fourth parties are recorded as listed by your vendors; the product does not discover them independently.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/vendor-risk-management. Purchasing routes and company information: www.moraph.com/how-to-buy.