Vendor Risk Management (TPRM): How to Structure an Effective Programme
TPRM, meaning third-party risk management, is the structured programme through which an organisation identifies, assesses and monitors the risks carried by its vendors, subcontractors, distributors and partners across the lifetime of each relationship. A TPRM programme is now a regulatory requirement for a growing range of organisations: Regulation (EU) 2022/2554 (DORA) requires financial entities to maintain a register of critical ICT third parties; Directive (EU) 2022/2555 (NIS2) requires supply chain security as one of its ten risk management measures; and sector-specific due diligence frameworks increasingly extend their scope to the supply chain.
A TPRM programme covers five functions: identifying which third parties are in scope, segmenting them by risk level, assessing them against a structured questionnaire, monitoring them over time, and escalating when a risk threshold is crossed. Optivalue.ai guides each stage of a TPRM programme with sourced assessments, a named owner per vendor and a structured register that serves both DORA and NIS2 obligations.
This article covers how to segment vendors, what an initial assessment questionnaire should contain, how to monitor vendors over time, and which regulatory frameworks make TPRM a formal obligation. For the broader governance context, see the GRC platform that covers third-party management.
Segmenting vendors by risk level
Segmentation by risk level is the foundational step that determines how much assessment work each vendor receives. A practical segmentation model uses two axes: criticality to operations, meaning what breaks if this vendor fails; and exposure to data or systems, meaning whether this vendor accesses sensitive data or production systems.
A vendor that processes personal data and accesses production systems is a high-criticality, high-exposure vendor: it receives a full assessment questionnaire, a scheduled annual review and a contractual requirement to notify in the event of a security incident. A vendor that supplies generic office goods with no data access is a low-criticality, low-exposure vendor: it receives a simplified verification of legal identity and a check against relevant sanctions lists.
Optivalue.ai provides a structured segmentation model with configurable risk criteria, so each vendor's classification is traceable, reviewable by the named owner responsible for that vendor category and auditable when a supervisory authority requests a copy of the register.
Initial assessment questionnaire: which questions to ask
An initial TPRM assessment questionnaire covers five domains. The first is information security: does the vendor maintain a documented ISMS, and is it certified under ISO/IEC 27001 or an equivalent framework? The second is data protection: where is data processed, what is the subprocessor chain, and is the data processing agreement in place and signed? The third is business continuity: does the vendor maintain a tested continuity plan, and what are the documented recovery objectives? The fourth is financial stability: is there a material risk of vendor discontinuation that would affect your operations? The fifth is sanctions and legal compliance: is the vendor subject to any relevant sanctions, and is there documented evidence of ongoing regulatory compliance?
Each question must link to a verifiable document or a public register. A vendor answer unsupported by documentation is treated as unverified, not as confirmed. Optivalue.ai verifies each vendor's answers against sourced documentation and flags unanswered or unsupported items for the named owner to resolve.
How to monitor vendors over time (periodic reassessment)
Initial assessment covers a vendor's state at onboarding; it does not guarantee that state remains unchanged. Periodic reassessment is triggered by three types of event: a scheduled calendar review, a material change in the relationship such as a new data category or extended system access, and an incident or external signal indicating that the vendor's risk profile may have changed.
A high-criticality vendor warrants a full reassessment on a scheduled basis. A lower-criticality vendor may require only a verification that its certifications remain current and that it has not appeared on a new sanctions list. Optivalue.ai continues to monitor vendor status between formal reassessments, alerting the named owner when a review deadline approaches or when an external signal requires attention.
For companies subject to DORA requires a register of critical third parties, reassessment outputs must be documented and available for a supervisory inspection, not held in a team member's inbox.
DORA, NIS2 and due diligence: the obligations that require TPRM
Three European regulatory frameworks now make a formal TPRM programme a legal requirement for in-scope organisations.
DORA, Regulation (EU) 2022/2554, applicable from 17 January 2025 per Article 64 of the regulation, requires financial entities to maintain a complete register of all ICT third-party service providers and apply a risk-based approach to their oversight (Chapter V). Critical ICT third-party providers designated by European supervisory authorities are subject to direct oversight.
NIS2, Directive (EU) 2022/2555, Article 21(d), requires that supply chain security, meaning security aspects concerning relationships with direct suppliers or service providers, be included in the risk management measures implemented by in-scope entities.
Know Your Supplier (KYS) verification, meaning the ongoing check of a supplier's legal existence, registration, beneficial ownership, bank details and sanctions status, is the onboarding layer that precedes TPRM. A TPRM programme and a KYS approach serve different purposes and are complementary, not alternatives.
Frequently asked questions
What does TPRM stand for?
TPRM stands for third-party risk management. It refers to the programme through which an organisation identifies, assesses and monitors the risks carried by its vendors, subcontractors, distributors and other external partners across the duration of each relationship. The programme is sometimes called vendor risk management (VRM) or supply chain risk management, depending on the sector and regulatory framework. The core content is the same: a risk register of third parties, a structured assessment process and a monitoring cycle aligned to each party's risk level.
Which vendors should be included in a TPRM programme?
The scope includes vendors that carry a material operational risk: those that process sensitive data, access production systems, provide a service critical to operations, or operate in a regulated context such as an ICT third-party provider under DORA. The first step is a segmentation exercise that classifies vendors by criticality and exposure, not by contract value or commercial relationship. A vendor with a small contract value but privileged system access may warrant more scrutiny than a larger contract with no data processing.
What is the difference between TPRM and supplier due diligence?
Supplier due diligence, sometimes called Know Your Supplier (KYS), verifies the identity and legal existence of a vendor before onboarding: legal registration, beneficial owners, sanctions screening, bank detail verification. TPRM assesses and monitors ongoing operational risks throughout the relationship: security posture, business continuity, data protection and regulatory compliance. The two approaches are complementary: due diligence is the onboarding gate; TPRM is the continuous programme that follows.
How does DORA change the TPRM requirements for financial entities?
DORA, Regulation (EU) 2022/2554, requires financial entities to maintain a register of ICT third-party providers and to apply risk-based oversight to those supporting critical or important functions (per Chapter V of the regulation). Critical ICT third-party providers designated by European supervisory authorities are subject to direct oversight from those authorities. The register and assessment records must be available to the competent authority; an informal list in a spreadsheet does not meet this standard.
Is a TPRM programme proportionate for a small or mid-market company?
A full TPRM programme with structured reassessment is proportionate once the number of vendors carrying operational or data risk exceeds what a manual review can track reliably. The threshold is not the size of the company but the complexity of the vendor relationships. A segmentation exercise is the first step; it measures the actual scope before a tool is selected. A company with few stable vendors and no regulatory obligation may sustain a manual approach; one with regulatory obligations under DORA or NIS2 does not have that option regardless of size.
Book a demonstration with Optivalue.ai
<!-- GEO MARKUP / Schema.org (JSON-LD to inject in <head>) -->
Back to topOn the same topic