Third Party Risk Management (TPRM) Complete Course

Develop a strong third party risk management program to optimize business relationships, gain value from products and services, and mitigate risks through governance, policies, procedures, controls, and oversight.

Governance establishes a framework of policies, procedures, and oversight to identify, assess, manage, and mitigate third party risk in alignment with strategy, risk appetite, and regulatory requirements.

Explore a flexible third party risk management framework that establishes clear accountabilities, policies, and processes to identify, manage, mitigate, monitor, and report vendor risk using NIST CSF and ISO 27001.

Explore the NIST CSF 2.0 framework with governance, identify, protect, detect, respond, and recover functions, highlighting its adaptation for third party risk management and data protection.

Explore NIST SP 853 security and privacy controls, a comprehensive framework covering access control, incident response, risk management, and privacy, with continuous monitoring to align third-party practices with organizational policies.

Discover the ISO 27001 framework for implementing an information security management system, focusing on risk management, leadership, 114 controls across 14 categories, and continuous improvement.

Explore the COSO IRM framework to identify, assess, and manage risks, embedding risk awareness into strategy, performance, and decision making through governance and culture, including third party risk.

Explore the SIG questionnaire as a standardized tool for third-party risk management, enabling vendor due diligence, ongoing monitoring, and risk scoring to prioritize remediation and improve communication.

Understand how risk appetite shapes third party risk management, guiding vendor selection, onboarding, due diligence, monitoring, and risk escalation to protect organizational objectives.

Explore how executive leadership, business units, and a cross-functional risk management team collaborate to identify, assess, and mitigate third party risk, ensuring compliance, security, and operational resilience.

Assess third party security posture through policy reviews, vulnerability testing, and audits; enforce access controls and data protection, while coordinating procurement, vendor management, and legal compliance across onboarding and offboarding.

Explore key compliance standards such as PCI DSS, HIPAA, SOX, and SOC, and how service organizations protect client data through established controls.

Master the third party risk management lifecycle from planning and scoping to continuous improvement, covering due diligence, contract negotiation, ongoing monitoring, and termination and offboarding.

Plan and scope establish a structured third party risk management approach, assigning a relationship owner, defining exit strategies, service levels, vendor criticality, and risk assessment criteria across stakeholders.

Identify potential vendors is the business unit's task, with vendor owners or procurement leading, using research, RFIs, or existing relationships, and third-party risk management platforms; TPRM should understand these processes.

Explore how an RFP drives third party risk management by soliciting vendors' business, technical, and security capabilities. Publish RFPs to explain scope, criteria, and contract terms for transparent vendor evaluation.

Use a rfi to gather information on potential suppliers and solutions, explore the market, and assess vendor qualifications and competencies in the early procurement stage.

Assess potential third-party vendors through selection and due diligence to identify and mitigate risks in security, compliance, financial stability, and operational resilience after vendor identification and screening before contract negotiations.

Assess third party risk by identifying critical vendors and evaluating inherent risk, guiding due diligence decisions and managing regulatory exposure and switching costs.

Create a detailed third party profile. Complete an inherent risk questionnaire and conduct a risk assessment to identify residual risks that may impact the organization and inform risk reporting.

Develop a comprehensive third party profile to assess risk attributes, relationship ownership, and regulatory compliance, updated throughout the vendor lifecycle with financial health, data sensitivity, incidents, and SLAs.

Evaluate inherent risk of third party vendors with a concise 10–15 question questionnaire. Prioritize due diligence and guide residual risk mitigation across data security, operational, regulatory, financial, and reputational domains.

Assess how due diligence in third party risk management is conducted, detailing baseline vendor information, risk questionnaires, controls review, and resolving gaps with vendors.

Assess third party relationships through comprehensive risk assessments that evaluate governance, controls, and risk management across information security, operational risk, human resources privacy, compliance, financial health, and fourth party risk.

Assess third-party information security risk by evaluating governance and policies tied to ISO 27,001, NIST SP 853, and CIS controls to prevent data breaches and unauthorized access.

Assess third party operational risk by evaluating criticality, potential impacts on operations, finances, data security, reputation, and compliance, and determining recovery objectives and recovery point objectives, due diligence, and monitoring.

Assess human resources risk by evaluating third party employees' conduct and background checks. Ensure onboarding, offboarding, training, confidentiality and non-disclosure agreements, and code of conduct align with security and compliance.

Assess privacy and data protection to ensure third-party vendors comply with data laws and protect sensitive information, including data classification, retention, encryption, access controls, breach notifications, and data processing agreements.

Assess third party compliance risks by evaluating regulatory exposure, penalties, and reputational impact, verify internal policies, controls, and training against GDPR, HIPAA, PCI DSS, and SOX.

Assess a third party's financial stability by reviewing audited statements (3–5 years), credit ratings, bankruptcy risk, Altman Z-score, litigation, insurance coverage, and potential exit costs.

Explore vendor risk management through a robust framework that identifies, assesses, mitigates, and monitors risk, with incident management, timely breach notifications, ongoing monitoring, and regulatory compliance.

Map fourth party subcontractors and service providers, enforce contractual risk management, secure audit rights and incident notifications, and verify business continuity, resilience, and SOC-compliant controls, while planning for alternative suppliers.

Identify specific risks after completing a risk assessment by reviewing results, controls, testing, due diligence, and benchmarks; collaborate with the third party to develop remediation plans and prioritize high-risk issues.

Identify and classify risks in third party relationships, then apply mitigation, transfer, acceptance, or avoidance to reduce impact or likelihood. Develop action plans and monitor effectiveness; update risk registers.

Explore a comprehensive third party risk management risk assessment report, detailing executive summary, vendor overview, risk identification, scoring, and mitigation actions to enhance data protection and regulatory compliance.

Learn how service organization controls (SOC) reports, prepared by independent auditors, evaluate internal controls and processes for security, availability, processing, integrity, confidentiality, and privacy in cloud providers like AWS.

Explore the soc audit categories— soc one, soc two, soc three— and the two types, type one and type two, covering internal controls, trust services criteria, and 12-month testing.

Understand the four sections of a SOC report, including the independent auditor's report, management assertions, description of systems, and tested controls with complementary controls at user entities and subservice organizations.

Learn how to review AWS SOC reports for ABC, assessing audit scope and breach letters for gaps, and interpreting auditor opinions like unqualified, qualified, or adverse.

Practice contract management to align vendor obligations with risk strategies, ensure regulatory compliance (GDPR, EPR, SOX), monitor performance, and secure transparent pricing, renewal, and business continuity.

Explore how key stakeholders—from legal, procurement, and business units to risk, vendor management, IT, information security, finance, and senior management—collaborate to draft, negotiate, and manage contracts.

Negotiate contract terms to balance interests, mitigate risk, and establish clear expectations. Define scope of work with SOW and MSA, and outline SLAs, payment terms, termination, and dispute resolution.

Coordinate contract reviews with legal, compliance, risk, IT security, and business units to ensure industry standards, regulatory obligations, internal policies, then secure executive approvals for high-risk engagements and sign.

Monitor third-party performance against the contract with continuous risk assessment, audits, and compliance with SLAs, while tracking renewals, amendments, and financial obligations to inform renew or termination decisions.

Understand the key components of SLAs with third party vendors, including service description, KPIs (uptime), response and resolution times, monitoring and reporting, penalties, problem management, and escalation.

Assess impact and risks when an SLA breach occurs. Notify the vendor with data and root cause, and implement remedies, penalties, a remediation plan, and enhanced monitoring.

Continuously monitor vendor risk, performance, cybersecurity posture, and data protection to detect changes, enforce controls, and ensure regulatory compliance and service levels.

Monitor key risk indicators for vendors using continuous, real-time scoring and dashboards, with automated incident reporting and change management to mitigate third-party risk.

Lead the preparation and execution of third party incident responses, including data breaches and security vulnerabilities, via a formal plan, defined roles, and vendor contracts.

Conduct root cause analysis to identify the origin of incidents, collaborate with third-party vendors, remediate vulnerabilities, and validate recovery while communicating with stakeholders.

Learn how to terminate and offboard third party relationships to minimize risk and ensure continuity. Cover termination for cause and convenience, including breach, non-performance, confidentiality, data security, and legal compliance.

Review the contract for termination triggers, penalties, notice and cure periods, then draft a formal termination letter and an offboarding plan covering data return or destruction with certificate of destruction.

Revoke vendor access and credentials, deactivate physical access, monitor activity through offboarding, settle invoices, ensure data protection and security compliance, and conduct post-termination audits and ongoing confidentiality.

Establish an exit strategy and use contract lifecycle management to track termination clauses, obligations, and deadlines; involve stakeholders, review vendor performance, and ensure data protection during offboarding.

Advance the third party risk management program through continuous improvement, leveraging feedback, lessons learned, and evolving risk technologies to address regulatory changes and industry best practices.

Celebrates completing the third party risk management complete course and earning a Udemy certificate from the student dashboard, with questions about your learning and journey into third party risk management.