SmartSuite for the Third-Party Risk Manager

Third-party risk. Distributes assessment surveys, scores responses and monitors completion automatically, with inherent and residual risk calculated from maturity, impact and likelihood.

Issues and actions. Assigns corrective actions to vendors, tracks due dates and escalates aging issues.

Compliance management. Maps vendor controls, documents and certifications to compliance frameworks.

Risk management. Rolls vendor risk into the enterprise register so supplier exposure is visible with other risk.

Reporting. Reports vendor risk by category, geography, business unit and tier.

What is a Third-Party Risk Manager accountable for?

The Third-Party Risk Manager is accountable for vendor risk across the supplier lifecycle: the vendor inventory with its criticality tiers, due diligence and risk assessment at onboarding and renewal, inherent and residual risk scoring, assignment and tracking of remediation for assessment gaps, monitoring of vendor performance, incidents and posture changes, coordination with procurement, legal, security and privacy on vendor obligations, and reporting of third-party risk exposure to the Chief Risk Officer and committees. Critical vendors are assessed before onboarding and re-assessed as they change.

How does SmartSuite help a Third-Party Risk Manager run vendor assessments?

Third-Party Risk Management distributes assessment surveys, scores responses and monitors completion automatically, with inherent and residual risk calculated from maturity, impact and likelihood, so an assessment cycle is launched to the vendors due, the Vendor Portal collects their responses and documents, and the scores are produced by the method rather than by hand. The Third-Party Risk Manager sees completion by vendor and tier and the Vendor Risk Analyst reviews the responses. Re-assessment on a posture change uses the same cycle.

How are assessment gaps remediated with vendors?

Issues Management assigns corrective actions to vendors, tracks due dates and escalates aging issues, so a gap found in an assessment becomes an action the vendor owns, visible to them through Vendor Portal, with a date and an escalation path when it slips. The Third-Party Risk Manager sees which vendors have overdue actions and can raise them with the Procurement Director before a renewal. Remediation stops being a list in an email thread.

How does this role map vendor controls and certifications to frameworks?

SmartSuite maps vendor controls, documents and certifications to compliance frameworks, so a vendor's SOC 2 report, ISO 27001 certificate or business associate agreement is attached to the vendor record and linked to the obligations it satisfies. The Compliance Manager and the Information Security Officer can see which vendors evidence which controls, and the Privacy Program Manager sees the processors covered. Contract Lifecycle Management (CLM) holds the contract and its obligations beside the assessment, which is what DORA's contractual requirements for ICT providers ask firms to evidence.

How does a Third-Party Risk Manager report exposure to the Chief Risk Officer?

Third-Party Risk Management reports vendor risk by category, geography, business unit and tier, and rolls vendor risk into the enterprise register so supplier exposure is visible with other risk, so the report to the Chief Risk Officer and the Enterprise Risk Director shows where exposure concentrates and how it sits beside the other principal risks. Committees see vendor risk in the same register as everything else. The view is read from the vendor records, so it is current when the committee meets.

What does a vendor risk program need to get started with SmartSuite?

The vendor inventory with its tiers, the assessment questionnaire in use, the scoring method and the open remediation items. New customers can start with SmartSuite Onboarding, a guided four-week program around one or two priority workflows; the first workflow is the assessment cycle for the vendors next due. Vendors are invited to the Vendor Portal as they are next assessed, so portal onboarding follows the cycle. Programs under the 2023 Interagency Guidance, DORA or HIPAA's business associate rules keep their existing method; SmartSuite runs it and keeps the file examiners test.