Answers to the 30 most frequently asked questions about third-party risk management, vendor governance, supplier risk, sanctions screening, and continuous monitoring — from the team at Enlighta.
Third-Party Risk Management
What is third-party risk management in simple terms?
Third-party risk management is how an organization identifies and manages risks associated with external vendors, suppliers, service providers, and their dependencies. It includes assessing risks before onboarding, monitoring changes during the relationship, resolving issues, and managing the eventual exit.
What is the difference between TPRM and vendor risk management?
The terms are often used interchangeably. TPRM may be used more broadly to describe risk across external relationships including vendors, subcontractors, service providers, and other business partners. Vendor risk management often focuses more specifically on vendor relationships.
What are the main types of third-party risk?
The main categories include cybersecurity and data privacy, operational, financial, regulatory and compliance, reputational, geopolitical, fourth-party, and concentration risk. The relevant categories depend on the nature and criticality of each relationship.
How often should third-party risk assessments be conducted?
Assessment frequency should reflect the organization’s policies, applicable requirements, relationship criticality, and risk exposure. Higher-risk relationships may require more frequent reviews and event-driven reassessments.
How does AI help with third-party risk management?
AI can assist with reviewing assessment responses, extracting information from documents, summarizing evidence, identifying potential anomalies, and prioritizing items for human review. Its effectiveness depends on data quality, appropriate controls, validation, and human oversight.
Supplier Risk & Governance
What is supplier risk management?
Supplier risk management is the ongoing discipline of identifying suppliers and their dependencies, segmenting them by criticality, screening and assessing risk, prioritizing through risk scoring, and continuously monitoring, mitigating and remediating changes as they emerge.
What is the difference between supplier risk management and TPRM?
They describe the same discipline at different altitudes. TPRM is the formal term used in regulated industries. Supplier risk management is the broader commercial usage. The controls, monitoring and governance are the same.
What is supplier risk management software?
A mature platform combines supplier inventory and profiles, segmentation, assessments and due diligence, risk scoring, external risk intelligence, continuous monitoring, fourth-party visibility, issues and remediation tracking, compliance tracking, dashboards and enterprise integrations.
Fourth-Party & Dependency Risk
What is fourth-party risk in simple terms?
Fourth-party risk is the risk an organization may face through the subcontractors or service providers used by its direct vendors. Problems involving these indirect providers can affect the services, information, or business operations that depend on them.
What is fifth-party risk?
Fifth-party risk refers to exposure arising from providers further down the dependency chain. The precise numbering depends on how the relationships are mapped, but the underlying concern is the potential impact of indirect dependencies on the organization.
How does fourth-party risk relate to continuous monitoring?
Direct vendors may rely on subcontractors and other underlying providers. Monitoring relevant changes in these dependencies can help organizations identify risks that would not be apparent from reviewing their direct vendor relationships alone.
Vendor Tiering & Classification
What is vendor tiering in simple terms?
Vendor tiering is the process of classifying vendors according to their business importance, risk exposure, and potential impact. It helps organizations decide how much assessment, monitoring, and governance each relationship requires.
What factors determine a vendor’s tier?
Factors may include business criticality, data access, cybersecurity exposure, regulatory requirements, financial and operational impact, geographic exposure, subcontracting relationships, and available risk information.
What is the difference between vendor tiering and vendor risk assessment?
Vendor tiering classifies a relationship to determine the appropriate level of oversight. Vendor risk assessment evaluates the relevant risks, controls, and evidence associated with the relationship. Assessment findings may also justify reviewing a vendor’s tier.
Can a vendor’s tier change after onboarding?
Yes. A vendor’s business role, access, dependencies, or risk exposure can change over time. Organizations should have a process to review classifications when material changes indicate that the existing tier may no longer be appropriate.
Continuous Monitoring
What is continuous monitoring in third-party risk management?
Continuous monitoring is the ongoing process of identifying and evaluating relevant changes that may affect the risk associated with vendors and other external relationships. Findings can inform investigation, reassessment, escalation, remediation, and ongoing governance.
What risks can continuous monitoring identify?
Depending on the organization’s monitoring scope, relevant signals may relate to cybersecurity, sanctions, adverse events, financial deterioration, operational disruption, compliance concerns, and changes in subcontractor dependencies.
What is the difference between continuous monitoring and periodic risk assessment?
Continuous monitoring identifies relevant changes between formal reviews. Periodic risk assessment evaluates the vendor’s risk profile, controls, and supporting evidence through a structured review. Monitoring findings can trigger an additional risk assessment when needed.
Is continuous monitoring the same as real-time monitoring?
Not necessarily. The timing and frequency depend on the information sources, data availability, and configured processes. Continuous monitoring describes an ongoing approach to risk visibility, not instantaneous detection of every event.
Sanctions Screening
What is sanctions screening in simple terms?
Sanctions screening is the process of comparing information about vendors and other relevant parties against applicable sanctions lists and watchlists to identify potential matches that require review.
What sources are used for sanctions screening?
Sources depend on the organization’s activities and applicable requirements. Common examples include OFAC, European Union sanctions sources, and United Nations sanctions sources. Organizations should confirm which sources are included in their specific screening arrangements.
Does a sanctions screening alert confirm a sanctions violation?
No. An alert identifies a potential match or concern that requires evaluation. The organization must validate the information and determine its significance under the applicable procedures before reaching a conclusion.
When should vendors be screened for sanctions?
Screening may be conducted during onboarding and at other points required by an organization’s compliance procedures. Ongoing or event-driven screening may also be appropriate when relevant information changes.
Contract Repository & Renewal
What is contract repository software?
Contract repository software is a digital solution that centralizes contracts and related documents so that users can organize, retrieve, and review contract information more easily.
What information can be extracted from contracts?
Depending on the document and available capabilities, information may include contract metadata, key clauses, commercial terms, pricing, deliverables, milestones, SLAs, obligations, renewal dates, expiration dates, and notices.
What is contract renewal management?
Contract renewal management is the process of tracking, reviewing, and managing contracts as they approach expiration or renewal milestones. It includes reviewing relevant contract terms, coordinating decisions, tracking deadlines, and following up on required actions.
What is the difference between a contract renewal and a contract extension?
A renewal generally refers to continuing a contractual relationship for another period under applicable renewal terms or a new agreement. An extension generally refers to extending the existing contractual period. The precise distinction depends on the agreement and its terms.
What is an automatic contract renewal?
An automatic contract renewal is a contractual arrangement under which an agreement renews for a further period unless a specified action is taken under the applicable terms. The actual requirements and deadlines depend on the contract.
Supplier Performance KPIs
What are the most important supplier performance management KPIs?
Common KPIs include on-time delivery, defect rate, SLA compliance, service availability, issue resolution time, cost variance, deliverable completion, corrective action closure, and continuous improvement.
What is the difference between supplier KPIs and SLAs?
KPIs measure performance against defined objectives. SLAs establish agreed service expectations and may specify targets, measurement rules, reporting requirements, and contractual consequences. Some KPIs are also used to measure SLA compliance.
How do supplier performance KPIs help manage risk?
Performance trends can reveal issues that may affect service continuity, operational resilience, contractual compliance, or business outcomes. However, performance KPIs do not replace a broader risk assessment or monitoring of cybersecurity, financial, and compliance exposures.
Explore More
These answers are drawn from Enlighta’s complete guide series on third-party risk management and vendor governance. Each linked guide provides detailed explanations, formulas, frameworks, and practical guidance.
- What Is Third-Party Risk Management?
- Supplier Risk Management: The Complete Guide
- What Is Fourth-Party Risk?
- What Is Vendor Tiering?
- What Is Continuous Monitoring?
- What Is Sanctions Screening?
- What Is Contract Repository Software?
- What Is Contract Renewal Management?
- Supplier Performance Management KPIs
Ready to see continuous third-party risk management in action? Explore the Enlighta TPRM solution or learn about Strategic Vendor Governance.
Legal disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute formal legal, financial, or regulatory advice. Third-party risk management and contract management requirements vary by jurisdiction, industry, and the circumstances of each organization, and regulatory guidance may change over time. Organizations should consult qualified legal counsel.
All third-party trademarks, product names, and company names referenced herein belong to their respective owners.
