Supplier tiering
Suppliers classified by the data, systems and services they touch, so effort matches risk.
Service offering
Third-party risk programme
Assessment effort matched to each supplier's risk, instead of one questionnaire for all.
We design how suppliers are assessed before and during the contract: tiering by inherent risk, proportionate due diligence, contract clauses for security and data, and continuous monitoring of the most critical suppliers. The programme reflects the third-party expectations in the frameworks your regulators apply.
The programme reflects regional outsourcing and third-party rules, such as the CBUAE outsourcing regulation and the UAE Information Assurance Regulation in the UAE, and SAMA's outsourcing rules and the third-party controls in NCA ECC in Saudi Arabia.
What the work involves
Due diligence and clauses
Assessment questionnaires and standard contract clauses for security, data and audit rights.
Continuous monitoring
Ongoing checks on critical suppliers, with residual risk reviewed and reported.
Proportionate controls
Controls sized to the risk, so effort goes where exposure is highest.
Owned by the business
Each control and policy has a named owner outside the GRC team.
When supplier risk needs a programme
A programme is needed when supplier reviews are one-off questionnaires and nobody watches critical suppliers after signing.
- Every supplier gets the same questionnaire, whatever its risk.
- Contracts lack security, data and audit clauses.
- Nobody reviews critical suppliers once the contract starts.
Talk to us about third-party risk programme
Share your constraints, compliance themes and timeline. We will return a phased approach, a staffing model and a risk register for your stakeholders to review.