Quarter's review order
- First: Cloud hosting provider.
- Order sensitive to: Sensitivity of data it can reach (counted half as much).
Global Compliance · Expanded Global Compliance
Vendor and Third-Party Risk
Track suppliers and subprocessors, their security assurances, data-access arrangements, contract controls, expirations and exceptions.
Demonstration: Quillfeather Retail Group (fictional) · Retail. Fictional data and a scripted answer.
The situation
- Organisation
- Quillfeather Retail Group (fictional)
- Who is asking
- Third-party risk manager
- Industry
- Retail
- What happened
- Only a few supplier reviews can be done each quarter and the manager must choose which suppliers come first.
The question asked
Which third parties should we review first, and does the order depend on how we weigh the risks?
What it reads, and who can see the result
- Supplier register registerSuppliers with what they do for us.
- Access and data map registerWhat each can reach.
- Assurance records registerCertifications and past reviews.
- Reads
- The supplier register, an access and data map and their assurance records.
- Does not read
- Contract prices or the content of data held by suppliers.
- Permission
- Third-party risk team's access.
- Who sees it
- The third-party risk manager and the CISO.
Try it
Change how much each criterion matters. The ranking is recomputed, and the page tells you whether the leader would survive a different judgement.
- 1Cloud hosting providerHosts the store; hard to move.Sensitivity of data it can reach: 4How critical it is to operations: 5Concentration (few alternatives): 5Gaps in its assurance evidence: 24.00
- 2Warehouse management SaaSRuns fulfilment; thin evidence.Sensitivity of data it can reach: 3How critical it is to operations: 5Concentration (few alternatives): 4Gaps in its assurance evidence: 43.95
- 3Payments processorHandles card data; certified.Sensitivity of data it can reach: 5How critical it is to operations: 5Concentration (few alternatives): 3Gaps in its assurance evidence: 13.73
- 4Marketing email platformCustomer emails; no recent review.Sensitivity of data it can reach: 4How critical it is to operations: 2Concentration (few alternatives): 2Gaps in its assurance evidence: 53.32
- 5Regional courierDelivers parcels; one of three.Sensitivity of data it can reach: 2How critical it is to operations: 3Concentration (few alternatives): 1Gaps in its assurance evidence: 22.09
The leader would change if Sensitivity of data it can reach (counted half as much). Treat the order as sensitive to that judgement.
Leader's margin over the next option: 0.05. The leader can change under another weighting.
The answer
Simulated answer. Written for this fictional case, not produced by a live model. Only the figures in it are computed, from what you decided above.
On these weights the first review should be: Cloud hosting provider (priority 4.00).
The score is a review priority: a higher score means more reason to look sooner [S1][S2][S3]. The order is could change under the weightings tested; it would change if Sensitivity of data it can reach (counted half as much).
A supplier with strong evidence and high stakes scores differently from one with weak evidence and low stakes, and the weights say which of those the organisation fears more.
Relies on: S1 · Supplier register and criticalityS2 · Data access mapS3 · Assurance records
Review and approval
The third-party risk manager decides. Approving sets the order of reviews for the quarter. It does not suspend, terminate or audit any supplier.
Ready for the reviewer.
In the product this is a different person with the right permission. Here you play that role to see the rule.
What it produces
Limits of this example
- Scores are illustrative judgements, not measurements.
- A low score does not mean a supplier is safe, only that it is later in the queue.
- This is a scripted demonstration on fictional data. No model was called and no real organisation, person or result is shown.
More in Global Compliance
- The compliance command centreObligations, deadlines and changes are scattered across inboxes and spreadsheets, so something is eventually missed.
- Corporate and financial regulationFilings, tax obligations, licences and entity records are tracked by different people, often on different dates.
- People, sector and international dutiesEmployment, privacy, security, environmental and cross-border duties sit with different teams and are rarely seen together.
- Assurance and evidenceWhen an auditor or an inspector arrives, evidence has to be found in a hurry, and gaps appear for the first time.
- Regulatory Applicability IntelligenceWork out which obligations may apply to this business from its legal entities, activities, industry, locations, workforce and other verified facts, and show each as appl…
- Regulatory Change Impact IntelligenceWatch approved authoritative sources, detect changes that matter, identify the entities, processes, systems and controls they affect, and start a governed review and rem…
- Continuous Control MonitoringEvaluate whether each control is operating: evidence present and current, expirations, exceptions and failures, so assurance is ongoing instead of a one-time checklist.
- Contract Compliance IntelligenceRead customer-authorised contracts for obligations, service commitments, deadlines, renewals, restrictions, responsibilities and compliance risks, with citations to the…
The Global Compliance story · This capability in the full register