Third Party Risk Management (TPRM)

The most common definition of Third Party Risk Management (TPRM) is a process that enables an organization to mitigate risks (Inherent and Residual) that Third Parties bring while supporting the business and solving business problems or requirements. TPRM, typically a function falls under the umbrella of Enterprise Risk and the TPRM policy drives the whole program. A well-defined and comprehensive policy conveys the seriousness with which the top management intends to implement, manage and commit to support the program. In today’s day and age, organizations have an unfathomable reliance on Third Parties to (but not limited to) support their operations, and client requirements, solve business challenges, and explore business opportunities. This policy should be published to every individual, business manager and senior management who is involved in the onboarding process of the Third Party.

The purpose is to build a risk aligned and scalable TPRM program to understand the security practices and ensure Third Parties meet the security standards of your organization while being compliant with local laws and regulations to operate within the risk tolerance levels defined in your organization, thus helping Business to securely consume products or services. This helps in safeguarding the security interest and assist business in making risk-informed decisions. The process should be repeatable and mature to support automation, innovation and optimization.

Ideally, the scope of Third Party Risk Management (TPRM) program is to identify, address and monitor the Risk Exposure by new, existing and Legacy Third Parties.

TPRM Lifecycle which at a high level involves managing onboarding, engaging with multiple teams for due diligence, engaging with Third Parties, Contract Management and Secure Off-boarding is the responsibility of Procurement (also called “Commercial” teams). Other teams that generally get involved are Privacy, Legal, Business verticals (Health care, life sciences), Corporate Functions (IT, HR, Ethics & compliance, ESG) and Data Governance which play a key role in the entire process.