Third-Party Risk Management: From Supplier Assessment to Risk Decisions
A free, structured TPRM learning pathway for aspiring and junior GRC analysts. Learn to classify suppliers, assess risks, evaluate evidence, manage findings and make defensible recommendations using practical exercises and the GRC Workshop TPRM Toolkit.
- Who it is for
- Aspiring GRC analysts, junior supplier risk analysts, career switchers, students and cybersecurity professionals new to TPRM`
- Before you begin
- No professional TPRM experience required. Basic knowledge of organisational risk and Microsoft Excel is helpful. The GRC Workshop ERM introductory lessons can provide additional background.
About this pathway
Third-Party Risk Management (TPRM) is an important part of GRC work. Organisations depend on external companies for technology, information processing and business services. These relationships can introduce security, resilience, data protection and operational risks.
Knowing the terminology is a starting point. In practice, an analyst must be able to understand a supplier relationship, ask relevant questions, evaluate the evidence, record uncertainty, identify material risks and explain what management needs to decide.
This free pathway takes you through that work in a structured order, using short learning assessments and practical examples.
What you will learn
By the end of the pathway, you should be able to:
- Classify suppliers by the potential impact of service failure or compromise.
- Write credible inherent supplier risk statements and assess likelihood and impact.
- Draft proportionate due diligence questionnaires linked to identified risks.
- Review ISO/IEC 27001 certification scope and SOC 2 reporting limitations.
- Distinguish effective controls, confirmed weaknesses and insufficient assurance evidence.
- Assess current residual risk separately from target exposure after remediation.
- Recommend treatment and explain risk appetite, ownership and approval responsibilities.
- Identify relevant contractual protections, monitor supplier changes and respond to third-party incidents.
- Plan supplier exit, assess shared dependencies and report findings to management.
- Apply the GRC Workshop TPRM Practitioner Toolkit v1.0 to a fictional supplier case.
How the pathway works
The pathway follows the supplier lifecycle from initial onboarding through ongoing monitoring and exit. Each step includes a reading and, where available, a knowledge check. Steps are sequential so that new learners can build on what they have already covered.
You can also access the individual articles and resources independently outside this pathway.
Practical resources
The TPRM Practitioner Toolkit v1.0 includes a clean Excel template and a worked example. Its 19 worksheets cover methodology, supplier inventory, criticality, risk assessment, questionnaires, assurance evidence, controls, findings, treatment, decisions, contracts, monitoring, incidents, concentration, exit and management reporting.
Use the accompanying Practitioner Handbook and the toolkit practical guide to understand the workbook workflow. In the clean workbook, appetite values are not automatically authorised; fictional training assumptions should be labelled as such. Supplier responses do not themselves establish control effectiveness, and recorded recommendations are not formal approvals.
Final assessment
The final integrated assessment contains 25 scenario-based questions worth 100 points, covering the complete TPRM lifecycle and toolkit decision principles. The proposed pass threshold is 75%, subject to configuration in the learning platform.
It tests your judgement using fictional supplier relationships. It does not issue professional accreditation or certify that you are authorised to make supplier risk decisions.
Who should take this pathway?
This guided route is intended for learners who are new to supplier risk management. More experienced practitioners can use individual lessons, the handbook and the toolkit without enrolling in the sequential pathway.
Start learning
Begin with TPRM fundamentals, complete the learning steps in order and work through the toolkit example before attempting the final assessment. Focus on the quality of the evidence and the reasoning behind your decisions, not just achieving a favourable risk score.
Loading your pathway…