What TPRM is
Third-party risk management (TPRM) is the process of identifying, assessing, controlling and monitoring the risks that come from relationships with outside parties: vendors, suppliers, service providers, contractors, distributors, agents and partners. “Vendor risk management” is often used as a synonym, though third parties include more than vendors.
The principle across regulators is the same: outsourcing an activity does not outsource the responsibility. US banking guidance states that “a banking organization’s use of third parties does not diminish its responsibility” to operate safely and comply with law.
For supplier risk in pharma and medical device manufacturing, see Supplier Risk Assessment: Methods, Criteria and Software for Life Sciences.
Why TPRM matters more in 2026
Verizon’s 2026 Data Breach Investigations Report, released May 19, 2026, found that breaches involving a third party accounted for 48% of all breaches, up 60% from the previous year. The 2025 report had put the share at 30%. Third-party exposure is now close to half of the breach picture.
Regulators have moved in the same direction:
| Rule or guidance | Third-party expectation |
|---|---|
| US Interagency Guidance on Third-Party Relationships (Fed, FDIC, OCC; June 6, 2023) | Risk management across the full relationship life cycle; replaced each agency’s earlier guidance |
| SEC Regulation S-K Item 106 (2023) | Public companies disclose whether they have processes to oversee and identify cyber risks from third-party service providers |
| DOJ Evaluation of Corporate Compliance Programs (Sept 2024) | Whether third-party risk management “allows for the review of vendors in a timely manner,” per Gibson Dunn |
| EU DORA (applies from January 17, 2025) | ICT third-party risk management, key contract terms, a register of information; on November 18, 2025 the European Supervisory Authorities designated 19 critical ICT third-party providers for direct oversight |
| Sector rules | For example GMP supplier controls in life sciences, HIPAA business associate agreements in healthcare |
The TPRM life cycle
The US interagency guidance organizes TPRM into five stages. It is written for banks, but the structure works for any organization.
| Stage | Key activities |
|---|---|
| 1. Planning | Define the need, the risks of using a third party and the criticality of the activity |
| 2. Due diligence and selection | Assess the third party’s ability to perform safely and compliantly |
| 3. Contract negotiation | Set performance standards, audit rights, data protection, incident notification, subcontracting, termination |
| 4. Ongoing monitoring | Track performance, risk changes, incidents and compliance |
| 5. Termination | Exit plans, data return or destruction, transition |
The guidance adds that “it is up to each banking organization to identify its critical activities,” and that the depth of oversight should match the risk.
Running a third-party risk assessment
- Inventory. List every third party and what it does for you. Many programs find relationships procurement never saw.
- Tier by inherent risk. Consider data access, system access, criticality to operations, regulatory relevance, customer impact and spend.
- Assess by tier. Questionnaires, document review, certifications, independent reports (for example SOC 2), and onsite or remote audits for the highest tier.
- Rate residual risk. After considering the third party’s controls and any gaps.
- Decide and document. Approve, approve with conditions, or decline; record limitations of the assessment.
- Contract. Turn findings into contract terms.
- Monitor. Reassess on a schedule by tier and on events (incidents, ownership change, new services).
The guidance stresses documenting gaps: when information is unavailable, “it is important for the banking organization to identify and document any limitations of its due diligence.”
Fourth parties and concentration
Your vendors have vendors. DORA and the US guidance both address subcontracting. Ask critical third parties which subcontractors they rely on for your services, and watch for concentration: many organizations depending on the same cloud or software provider. The EU’s designation of 19 critical providers, including hyperscale cloud and data center providers, shows regulators see this as a system-level risk.
Common weaknesses
- Incomplete inventory. Third parties onboarded outside procurement.
- One-size-fits-all questionnaires. Low-risk vendors over-assessed, critical ones under-assessed.
- Self-attestation accepted at face value. Questionnaire answers never checked against evidence.
- Assessments that never reach contracts. Findings not turned into obligations.
- No ongoing monitoring. Risk rated once at onboarding.
- Slow reviews. Backlogs that push business teams to work around the process.
TPRM checklist
- Complete third-party inventory with owners
- Inherent risk tiers with documented criteria
- Assessment depth matched to tier
- Questionnaire answers verified against documents and reports
- Limitations of due diligence documented
- Contract terms reflect assessment findings
- Fourth parties and concentration considered for critical relationships
- Monitoring schedule and event triggers defined
- Exit plans for critical third parties
Speed up third-party assessments with AskDona
Third-party assessments mean reading a lot of documents: questionnaires, SOC reports, certificates, policies, contracts. AskDona reads them together against your assessment criteria, flags gaps and contradictions (for example a questionnaire answer the SOC report does not support, or a missing incident notification clause), and links each finding to the source page. Run a sample third-party assessment on one critical vendor. AskDona shows the evidence; your risk team decides.
FAQ
What does TPRM stand for? Third-party risk management: managing the risks that come from relationships with vendors, suppliers, service providers and other outside parties.
What is a third-party risk assessment? An evaluation of a third party’s controls and risks before and during the relationship, scaled to how critical and risky the relationship is.
What are the stages of TPRM? Planning, due diligence and selection, contract negotiation, ongoing monitoring and termination, as set out in the 2023 US interagency guidance.
What is third-party compliance? Making sure third parties meet the legal, regulatory and contractual requirements that apply to the work they do for you, and that you can show it.
What is a fourth party? A subcontractor or provider used by your third party. Critical fourth parties can carry risk to you even without a direct contract.
References
All pages opened and checked by October 14, 2026.
| Source | Type | Used for |
|---|---|---|
| Federal Reserve, interagency guidance press release (June 6, 2023) | US regulator | Life cycle stages |
| Federal Register, Interagency Guidance on Third-Party Relationships | US guidance | Responsibility, critical activities, documenting limitations |
| Verizon, 2026 DBIR release (May 19, 2026) | Industry report | 48% third-party breaches |
| Verizon, 2025 DBIR release (Apr 23, 2025) | Industry report | 30% figure |
| eCFR, Regulation S-K Item 106 | US regulation | Third-party service provider disclosure |
| Gibson Dunn, DOJ updates ECCP (Sept 2024) | Law firm client alert | Timely vendor review |
| EIOPA, DORA | EU supervisory authority | DORA application |
| Morgan Lewis, DORA critical ICT providers list (Nov 2025) | Law firm blog | 19 designated CTPPs |