Third-Party Risk Management Terminology Guide

Assessment

An evaluation of the risks associated with third-party vendors and partners.

Assets

Encompass applications, databases, and other resources utilized within your organization in relation to the vendor to provide a more granular view of a vendor’s footprint.

Attributes

Used to configure the detail fields of your vendor records. You can add, edit, activate, or deactivate attributes.

Automation rule

Used to create and configure inventory rules to automatically launch assessments, send emails, and send reports.

Certificates

Used to  track adherence of the vendor to established security or privacy standards in vendor records.

Compliance evaluation

An evaluation that considers up-to-date legal requirements and industry frameworks to faciliate efficient and accurate compliance assessments for your third-parties.

Control Framework

Can be added to your Control's Library and implemented throughout your inventories. Once the framework has been added to your library, you can access the control name, control category, implementation guidance, and evidence tasks.

Due Diligence

The maintenance of pre-discussed responsibilities third-parties have to sustain after beginning an engagement in order to remain compliant.

DUNS

A unique, nine digit number used to identify businesses.

Engagement

Refers to the active involvement, communication, and interaction between an organization and its external vendors or third-party entities.

Entity

Refers to any third-party organization or individual that your business interacts with.

Exchange

A section of the application that provides risk intelligence data enables you to continuously monitor your extended enterprise between assessments and can be used as a baseline to tailor the depth of third-party risk assessments, enabling you to focus on the most critical risks.

Incident Response

A tool that centrally manages incident investigations and documentation.

Mitigation

Refers to the actions and strategies implemented to reduce the potential negative impact of risks associated with third-party vendors. This involves identifying potential risks, assessing their severity, and taking proactive steps to minimize or eliminate these risks.

Regulatory Requirements

Various laws, regulations, and standards that organizations must comply with when managing their third-party relationships.

Risk Analytics

The use of data and analytical tools to assess, quantify, and manage risks associated with third-party vendors.

Risk Appetite

The level of risk an organization is willing to accept in its third-party relationships to achieve its objectives.

Risk Assessment

The evaluation of potential risks that third-party vendors may pose to your organization.

Risk Assessment Workflow

Outlines the structured process for evaluating and managing risks associated with third-party vendors.

Risk-Based Approach

The prioritization and management of third-party risks based on their potential impact on your organization.

Risk Dashboard

A visual tool that provides a comprehensive overview of the risk landscape associated with your third-party vendors.

Risk Exposure

The potential impact that risks associated with third-party vendors can have on your organization.

Risk mitigation strategies

The implementation of measures to reduce or eliminate the risks posed by third-party vendors.

Sanction

A penalty or restrictive measure imposed by governments or international bodies on individuals, entities, or countries.

Screening

The conduction of compliance checks on third-party vendors to identify any potential risks or red flags.

Service Level Agreement (SLA)

A formal contract between your organization and a third-party vendor that defines the expected level of service.

Stage

Refers to a specific phase in the process of evaluating and managing third-party vendors. Each stage represents a distinct step in the workflow, ensuring that all necessary actions are taken to assess and mitigate risks.

Stage Rule

A set of predefined conditions and actions that automate various processes within the TPRM framework.

Template

A pre-defined framework or set of guidelines used to standardize various processes and assessments.

Third Party

Refers to any external entity that your organization engages with to provide goods, services, or support.

Third party risk management life cycle

Encompasses the entire process of managing risks associated with third-party vendors. This life cycle ensures that risks are identified, assessed, mitigated, and monitored throughout the relationship with the vendor.

Third-Party Ecosystem

Refers to the network of all third-party vendors, suppliers, contractors, and partners that an organization engages with.

Third-Party Risk Exchange

Provides access to risk ratings and critical information on thousands of third-party vendors. This exchange helps organizations streamline their third-party risk evaluations and continuously monitor for new threats.

Third-Party Risk Management (TPRM)

The systematic process of assessing, mitigating, and monitoring risks associated with third-party vendors.

Vendor

Any external entity that provides goods, services, or support to your organization. Examples of vendor types include: suppliers, service providers, contractors and consultants, partners and affiliates, and more.

Vendor Lifecycle Management

The comprehensive process of managing third-party vendors from initial engagement through to offboarding.

Vendor Risk Assessment Questionnaire (VRAQ)

A tool used to gather detailed information about a vendor’s risk profile.

Vendor Risk Assessment Template

A tool used to evaluate the risk profile of third-party vendors. These templates help streamline the assessment process and ensure consistency.

Vendor Risk Profile

A comprehensive summary of the potential risks associated with a specific third-party vendor.

Vendor Risk Rating

A quantifiable measure that indicates the level of risk associated with a specific third-party vendor. This rating helps organizations prioritize their risk management efforts and make informed decisions about their vendor relationships.

Workflow

The automated processes that streamline and manage the various stages of third-party interactions.

Workflow Rule

The specific criteria or conditions that must be met for a vendor to progress from one stage of the risk management workflow to the next.