Third-party risk management (TPRM)

---

Third-party risk management is the set of processes by which an organization identifies, assesses, mitigates and monitors the risks its suppliers and partners create, including integrity, labor, operational, financial, information security and reputational risk. A mature program has four components: segmentation by criticality, due diligence proportional to risk, contractual controls, and continuous monitoring. The most common failure is applying uniform effort to every third party, which produces friction on the irrelevant ones and superficiality on the critical ones.

In Verdana: see the Compliance modules.