TPRM Resource Hub · Start Here
Supplier Risk Management
Supplier risk management (SRM) is the discipline of identifying, assessing, contracting, monitoring and remediating the risks an organization takes on through its third-party suppliers and vendors across the entire relationship lifecycle. This guide explains how a working SRM program fits together — with free templates and deep-dive guides for each stage.
Built for vendor managers, procurement, risk, compliance, security and legal teams.
What is supplier risk management?
Supplier risk management is the structured practice of controlling the exposure a company inherits when it depends on external suppliers for products, services, data handling or critical operations. Unlike a one-time vendor assessment, SRM is continuous: it starts before contract signature and runs through onboarding, performance monitoring, renewal and exit.
You will also hear the terms third-party risk management (TPRM) and vendor risk management (VRM). In practice they describe the same discipline at slightly different scopes — TPRM emphasizes regulatory obligations around all third parties, VRM often centers on IT and service vendors, and SRM frames the same risks around the supplier relationship. The controls are shared: due diligence, risk tiering, contractual protections, ongoing monitoring and evidence-based reviews.
Why supplier risk management matters
Regulatory pressure
Regulators increasingly expect evidence of oversight — from DORA and EBA outsourcing guidelines in the EU to SEC disclosure expectations in the US. Point-in-time assessments no longer satisfy examiners.
Hidden dependencies
Your suppliers have suppliers. Fourth-party concentration risk — many vendors relying on the same cloud, region or sub-processor — propagates outages and breaches into your operations.
Value leakage
Unmanaged obligations, missed SLAs and unclaimed credits quietly erode contract value. SRM connects commitments in the contract to measured performance and remediation.
The five stages of an SRM program
- Identify and onboard. Capture every supplier, service and dependency in a central register. A structured onboarding process collects ownership, data access, locations and subcontractors before risk decisions are made. (25-step onboarding checklist)
- Assess and tier. Score each supplier on security, compliance, financial and operational risk, then tier them so diligence depth matches exposure. A documented methodology keeps assessments consistent and defensible. (assessment template · what is vendor tiering?)
- Contract and protect. Convert risk findings into contractual language — notification windows, audit rights, security requirements, exit and transition duties — then track obligations after signature. (TPRM policy template · obligations tracking template)
- Monitor continuously. Replace annual questionnaires with ongoing signals: sanctions and adverse media screening, performance SLAs, certification expiries and fourth-party changes. (continuous monitoring explained · sanctions screening essentials)
- Review, remediate and renew. Feed findings back into supplier scorecards, corrective action plans and renewal decisions — so risk data changes commercial outcomes. (supplier scorecard template · contract renewal management)
The risk categories every program should cover
Security and privacy
Access controls, incident notification, data handling and resilience of the supplier’s own environment.
Compliance and legal
Certifications, regulatory adherence, sanctions exposure, audit cooperation and indemnities.
Financial health
Supplier viability, ownership changes and concentration that could interrupt service delivery.
Operational performance
SLAs, delivery reliability, support quality and outage handling against agreed measures.
Concentration and fourth-party
Sub-processors, shared infrastructure and geographic concentration behind your suppliers. (fourth-party risk)
Exit and transition
Data return, asset recovery, knowledge transfer and the practical ability to switch suppliers.
How to measure whether SRM is working
A mature program is measured, not assumed. Track a small set of KPIs — assessment cycle time, percentage of tiered suppliers with current assessments, SLA breach rate and remediation time, obligation completion rate, and concentration visibility. Our vendor management KPIs guide lists the metrics with formulas and targets, and the original KPI benchmarks article covers baseline expectations by program maturity.
Deep-dive guides
What Is Third-Party Risk Management?
The complete TPRM reference: risk types, lifecycle and governance.
Guide
What Is Fourth-Party Risk?
Your suppliers’ suppliers — why Nth-party visibility matters.
Guide
What Is Vendor Tiering?
How to rank vendors by risk so diligence matches exposure.
Guide
What Is Contract Renewal Management?
Turning renewals into risk reviews instead of auto-extensions.
Guide
What Is Contract Repository Software?
Centralizing agreements, obligations and renewal triggers.
Guide
Continuous Vendor Risk Monitoring
Beyond point-in-time due diligence to always-on signals.
Guide
Sanctions Screening Essentials
Screening cadence, watchlists and evidence for regulators.
Metrics
Vendor Management KPIs
The KPIs that prove SRM works, with formulas and targets.
FAQ
Vendor Management & TPRM FAQ
30 answered questions across the whole program.
Free downloadable templates
Vendor Risk Assessment Template
Score third-party risk across domains, with scoring guide.
Excel + Guide
Supplier Scorecard Template
KPIs, SLAs, ratings and improvement actions per supplier.
Word Framework
TPRM Policy Template
The policy sections, roles and requirements regulators expect.
Checklist
Vendor Onboarding Checklist
25 steps from intake to go-live readiness.
Excel Register
Contract Obligations Tracker
Owners, triggers, due dates and evidence for every commitment.
Frequently asked questions
What is supplier risk management in simple terms?
It is the practice of knowing which suppliers create which risks for your organization, controlling those risks through contracts and monitoring, and fixing issues before they become incidents — continuously, not once a year.
How is supplier risk management different from vendor management?
Vendor management covers the whole commercial relationship — performance, cost, service. Supplier risk management is the risk-control layer inside it: due diligence, tiering, contractual protections, monitoring and remediation.
What does a supplier risk register include?
Each supplier and service, risk tier, data access and locations, key contracts and obligations, assessment dates and results, open issues and remediation owners, and fourth-party dependencies.
How often should supplier risk be reviewed?
Match cadence to risk tier: continuous automated monitoring for critical suppliers, quarterly or semi-annual reviews for high-tier, and annual confirmation for low-tier — plus event-driven reviews on breaches, ownership changes or sanctions hits.
Keep learning
This hub is maintained by the Enlighta team. Enlighta’s platform automates third-party risk and vendor governance — assessments, monitoring, obligations and performance in one system. Explore the guides above, or read the EBA third-party risk guidelines summary for a regulatory perspective.
This guide is general information, not legal advice. Assess your obligations with qualified counsel.
Run SRM the way regulators expect
Central registers, tiered assessments, continuous monitoring and obligation tracking — without spreadsheets falling over. Start with the free templates above, then see how Enlighta automates the whole lifecycle.
What Is Vendor Management?
The complete vendor lifecycle, systems and best practices.
What Is Vendor Risk Management?
The complete VRM reference: assessments, monitoring, remediation.
Vendor Risk Management Process
The step-by-step process flow from intake to exit.
What Is Continuous Monitoring?
Always-on vendor risk signals beyond annual reviews.
Key Risk Indicators (KRIs) for Vendors
10 KRI examples, thresholds and monitoring across the lifecycle.
Vendor SLA Tracking Template
SLA targets, actuals, breaches, corrective actions — with guide.
