SmartSuite for the Third-Party Risk Manager

Vendors are segmented by criticality, data access, geography and inherent risk at intake, and the tier decides the questionnaire, the review path and the re-assessment cycle. A critical vendor cannot be onboarded on a light-touch review by accident.

Assessment surveys go out through the Vendor Portal, responses are scored and completion monitored automatically, and inherent and residual risk are calculated from maturity, impact and likelihood on a method the Vendor Risk Analyst applies the same way every time.

Continuous review cycles, score updates and alerts keep each vendor's risk posture current between assessments, so an incident, a lapsed certification or a change of ownership triggers a review rather than waiting for the renewal date.

Assessment gaps become corrective actions assigned to the vendor through the Vendor Portal, with due dates, automated follow-up and escalation of aging issues, so remediation is a tracked exchange with the supplier and the Information Security Officer sees its status.

Risk obligations link to contracts, SLAs and compliance requirements in Contract Lifecycle Management (CLM), so the Legal Operations Manager and Procurement Director see which clauses a finding touches before a renewal is negotiated.

Vendor risk rolls into the enterprise register so supplier exposure sits with operational, IT and compliance risk on the same scale, and the Compliance Manager's framework mapping and the Privacy Program Manager's processor records read the same vendor profile.

Real-time dashboards show risk levels, heat maps, review cycles, exceptions and remediation progress across the vendor base, cut by category, geography, business unit and tier, so the Chief Risk Officer's question is answered with a filter. The AI Assistant in a SmartDoc field drafts the summary.

SOC reports, attestations and certifications are held with version control and mapped to ISO 27001, SOC 2, NIST, GDPR and HIPAA requirements, so a vendor's evidence answers the framework question once and the Compliance Manager reuses it.

Every update, decision, submission and remediation action is recorded automatically, with role-based permissions and secure evidence upload, so a bank examiner applying the Interagency Guidance or a HIPAA business associate review is walked through the vendor's record.

Chief Risk Officer

The Third-Party Risk Manager is accountable for vendor risk across the supplier lifecycle: the vendor inventory with its criticality tiers, due diligence and risk assessment at onboarding and renewal, inherent and residual risk scoring, assignment and tracking of remediation for assessment gaps, monitoring of vendor performance, incidents and posture changes, coordination with procurement, legal, security and privacy on vendor obligations, and reporting of third-party risk exposure to the Chief Risk Officer and committees. Critical vendors are assessed before onboarding and re-assessed as they change.

Third-Party Risk Management distributes assessment surveys, scores responses and monitors completion automatically, with inherent and residual risk calculated from maturity, impact and likelihood, so an assessment cycle is launched to the vendors due, the Vendor Portal collects their responses and documents, and the scores are produced by the method rather than by hand. The Third-Party Risk Manager sees completion by vendor and tier and the Vendor Risk Analyst reviews the responses. Re-assessment on a posture change uses the same cycle.

Issues Management assigns corrective actions to vendors, tracks due dates and escalates aging issues, so a gap found in an assessment becomes an action the vendor owns, visible to them through Vendor Portal, with a date and an escalation path when it slips. The Third-Party Risk Manager sees which vendors have overdue actions and can raise them with the Procurement Director before a renewal. Remediation stops being a list in an email thread.

SmartSuite maps vendor controls, documents and certifications to compliance frameworks, so a vendor's SOC 2 report, ISO 27001 certificate or business associate agreement is attached to the vendor record and linked to the obligations it satisfies. The Compliance Manager and the Information Security Officer can see which vendors evidence which controls, and the Privacy Program Manager sees the processors covered. Contract Lifecycle Management (CLM) holds the contract and its obligations beside the assessment, which is what DORA's contractual requirements for ICT providers ask firms to evidence.

Third-Party Risk Management reports vendor risk by category, geography, business unit and tier, and rolls vendor risk into the enterprise register so supplier exposure is visible with other risk, so the report to the Chief Risk Officer and the Enterprise Risk Director shows where exposure concentrates and how it sits beside the other principal risks. Committees see vendor risk in the same register as everything else. The view is read from the vendor records, so it is current when the committee meets.

The vendor inventory with its tiers, the assessment questionnaire in use, the scoring method and the open remediation items. New customers can start with SmartSuite Onboarding, a guided four-week program around one or two priority workflows; the first workflow is the assessment cycle for the vendors next due. Vendors are invited to the Vendor Portal as they are next assessed, so portal onboarding follows the cycle. Programs under the 2023 Interagency Guidance, DORA or HIPAA's business associate rules keep their existing method; SmartSuite runs it and keeps the file examiners test.