thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Foundational

Third-Party Risk Management (TPRM)

Discipline of identifying, assessing, mitigating, and monitoring risks from vendors, suppliers, and other external parties.

Definition

The TPRM life cycle covers planning and inventory, risk-based tiering by inherent risk and criticality, due diligence, contracting with security and privacy terms, ongoing monitoring, and offboarding. Regulators such as US banking agencies (2023 interagency guidance) and DORA expect board-level oversight. Platforms such as ServiceNow TPRM automate assessments and issue tracking.

Example

A vendor that will host customer PII is tiered critical and receives a full assessment, SOC 2 review, and annual reassessment.

Exam tip

Outsourcing a function does not outsource accountability for its risk.

Related terms