Third-Party Risk Management

A vendor risk program that tiers vendors by criticality and data access, so due diligence goes where the risk is.

Our work is advisory. We don't perform financial statement audits or provide attest services.

You can outsource the service. You can't outsource the accountability.

The challenge

Your ven­dors run es­sen­tial ser­vices, han­dle sen­si­tive data, and con­nect di­rect­ly to your sys­tems. When their con­trols fail, the con­se­quences land on you, and reg­u­la­tors ex­pect you to have seen it com­ing. Most pro­grams spread thin across hun­dreds of low-im­pact sup­pli­ers while the crit­i­cal few go un­watched.

How we help

We start with each ven­dor's role in your busi­ness: what data it touch­es, what ac­cess it holds, and what hap­pens the day it stops. Those an­swers set the depth of due dili­gence and mon­i­tor­ing, so ef­fort goes to the ven­dors that carry real risk.

Next, we check whether the ven­dor's ev­i­dence cov­ers the ser­vices you ac­tu­al­ly use. That means read­ing SOC re­ports close­ly: their scope, ex­cep­tions, carved-out sub­ser­vice or­ga­ni­za­tions, and the com­ple­men­tary user en­ti­ty con­trols your own team is ex­pect­ed to run. Those last con­trols are easy to miss and often go untest­ed.

Then we set up mon­i­tor­ing that catch­es the events that should trig­ger a fresh look, such as an ac­qui­si­tion, a host­ing change, a se­cu­ri­ty in­ci­dent, or a new AI fea­ture. Our team has built and run third-party risk pro­grams on plat­forms such as OneTrust, so the process we de­sign holds up at real vol­ume.

What you get

  • Vendor tiering by service criticality and data access
  • Due diligence questionnaires and security evidence review
  • SOC report review: scope, exceptions, carve-outs, and the user entity controls your team must run
  • Third-party AI review: data handling, model training, and provider accountability
  • Fourth-party and concentration risk review
  • Event-driven reassessment and ongoing monitoring
  • Guidance on contract terms, service continuity, and exit planning

Standards we work with: The 2023 Interagency Guidance on Third-Party Relationships, NIST SP 800-161, ISO/IEC 27036, and the AICPA SOC re­port­ing frame­work.

Good fit if you rely on cloud and soft­ware ven­dors and can't show how each one was re­viewed.

Questions clients ask

How many vendors need a full review?

Usually fewer than you think. Tiering by criticality and data access shows which vendors need deep due diligence and which need a lighter check, so your team's time goes where the risk is.

Can you work with our existing TPRM platform?

We design the process around the tool you already have. Our team has built and run third-party risk programs on platforms such as OneTrust.

More in Governance, Risk & Compliance

IT Risk Assessment

Identification and rating of the risks across your IT environment and critical business systems, measured against your risk appetite.

  • Risk identification across systems, processes, and IT operations
  • Likelihood and impact ratings tied to your risk appetite
  • A risk register with owners and treatment decisions
Learn more about IT Risk Assessment

Cybersecurity Risk Assessment

A threat-informed assessment of the cyber risks to your most important data and systems, rated in business terms.

  • Critical asset and data identification
  • Threat scenarios rated in business terms
  • A prioritized treatment plan for leadership
Explore about Cybersecurity Risk Assessment

Cloud Risk Assessment

An assessment of the risks in how you use the cloud, including provider dependence, data location, shared responsibility, and exit options.

  • Cloud service inventory and data classification
  • Provider, concentration, and exit risk
  • Shared responsibility gaps rated against your risk appetite
Learn more about Cloud Risk Assessment

GRC Program and Control Framework Design

One control library that links your risks, policies, controls, and obligations, so risk, compliance, and audit work from the same list.

  • An integrated risk and control library
  • A compliance obligations register linked to tested controls
  • Risk appetite statements and board reporting
Learn more about GRC Program and Control Framework Design

Information Security Policy Writing

Information security policies and standards, written or rewritten to fit how you operate and mapped to the frameworks your customers expect.

  • A policy and standard set sized to your organization
  • Mapping to NIST, ISO/IEC 27001, and SOC 2 criteria
  • An owner and review cycle for each document
Learn more about Information Security Policy Writing

Remediation Management

Issue and remediation tracking with owners, dates, and escalation, plus validation that each fix addresses the original risk.

  • Issue intake and prioritization
  • Owners, deadlines, and escalation paths
  • Closure validation before issues are closed
Learn more about Remediation Management

Vendor SOC Report Review

A close reading of your vendors' SOC reports: scope, exceptions, carved-out subservice organizations, and the user entity controls you must run.

  • Scope and coverage check against the services you use
  • Exception and carve-out analysis
  • Complementary user entity controls mapped to owners
Learn more about Vendor SOC Report Review

SOC 2 Readiness

Scoping, gap assessment, control design, and evidence preparation before your CPA firm begins the SOC 2 examination.

  • Type 1 or Type 2 scoping and criteria selection
  • Gap assessment and control design
  • Evidence planning and practice walkthroughs
Explore about SOC 2 Readiness

ISO/IEC 27001 Readiness

Scoping, gap assessment, and ISMS build-out to prepare you for an ISO/IEC 27001:2022 certification audit.

  • ISMS scope and Statement of Applicability
  • Risk assessment and treatment plan
  • Internal audit and management review planning
Explore about ISO/IEC 27001 Readiness

HIPAA and PCI DSS Readiness

Gap assessments and control design for the HIPAA Security Rule and PCI DSS v4.0, ahead of your assessor or regulator.

  • HIPAA Security Rule risk analysis support
  • PCI DSS v4.0 scoping and gap assessment
  • Control design and evidence preparation
Learn more about HIPAA and PCI DSS Readiness

View All Services

Ways to work with us

Project engagements

A defined scope, timeline, and deliverable, such as an IT review, an AI governance build, or a remediation plan.

Advisory support

Ongoing access to senior guidance as your program, systems, and regulators change.

Audit capacity support

Added hands and specialist skill for your internal audit or risk team, working under your direction.

Training programs

Workshops and cohorts for your team, delivered on a schedule that suits you.

How we engage

  1. Discovery

    A short call to understand your situation.

  2. Scoping

    A written scope with deliverables, timing, and fees.

  3. Delivery

    Regular check-ins and findings you can read in one sitting.

  4. Follow-up

    A review of progress, plus support for what comes next.

Common questions

Are you a CPA firm?

No. We're a risk and tech­nol­o­gy ad­vi­so­ry firm. We don't per­form fi­nan­cial state­ment au­dits or issue audit opin­ions.

Can you help us prepare for SOC 2 or a similar report?

Yes, on the readi­ness side: gap as­sess­ment, con­trol de­sign, and ev­i­dence prepa­ra­tion. The re­port it­self must come from a li­censed CPA firm.

Do you work with our internal and external auditors?

Yes. We co­or­di­nate with in­ter­nal audit, your ex­ter­nal au­di­tors, and your com­pli­ance team so work isn't du­pli­cat­ed.

How long does an engagement take?

It de­pends on scope. After a scop­ing call, you'll get a time­line in writ­ing.

What size organizations do you work with?

Mid-mar­ket and en­ter­prise or­ga­ni­za­tions across in­dus­tries.

Will you keep our information confidential?

Yes. We'll sign an NDA be­fore you share sen­si­tive de­tails.

Can you assess an AI program you helped design?

No. We don't audit or as­sess an AI pro­gram, sys­tem, or use case we de­signed for the same client. If an en­gage­ment would cross that line, we'll tell you dur­ing scop­ing.

Is this legal advice?

No. We sup­port reg­u­la­to­ry align­ment from a risk and con­trols per­spec­tive. For legal ques­tions, work with coun­sel.

Not sure which service fits?

Describe the problem. We'll tell you where to start.

Talk to an Advisor