Third-party risk management (TPRM) is the practice of identifying, assessing and monitoring the risk an organisation takes on through its suppliers, vendors and service providers — continuously, rather than once at onboarding.
Third-party risk management (TPRM) is the practice of identifying, assessing and monitoring the risk an organisation takes on through its suppliers, vendors and service providers — and doing so continuously, rather than once at onboarding.
The scope is wider than most programmes assume. It covers anyone who processes your data, has access to your systems, or whose failure would interrupt your service — which usually includes contractors and sub-processors nobody put on the vendor list.
What a TPRM programme actually contains
- An inventory of third parties, with an owner named for each.
- A tiering rule that decides how much diligence each vendor gets.
- An assessment — usually a questionnaire plus evidence — sized to the tier.
- A re-assessment cadence, and a trigger for reassessing early.
- A route from a finding to somebody's task list.
How TPRM differs from vendor management
Vendor management is commercial: contracts, spend, service levels, renewal dates. TPRM is about the risk the relationship introduces. They share a vendor list and almost nothing else, and running them as one function usually means the risk half quietly loses.
The terms are used interchangeably. TPRM is the broader one: it includes parties who are not vendors in a commercial sense, such as a partner processing data under a joint agreement.
By tier. Critical vendors annually at minimum, with an out-of-cycle reassessment triggered by a breach, an ownership change or a material change in the service.
Yes, in substance. RBI's outsourcing directions and the DPDP Act's processor obligations both require diligence over third parties, though neither uses the term.
Facts last verified 20 Jun 2026
