Software

Gain a 360-degree view of third-party risk by using our SaaS software to centralize, track, automate, assess and report on your vendors. 

Managed Services

Let us handle the manual labor of third-party risk management by collaborating with our experts to reduce the workload and mature your program. 

Overview
Document Collection
Policy/Program Template/Consulting
Virtual Vendor Management Office
Vendor Site Audit

Ongoing Monitoring

Let us handle the manual labor of third-party risk management by collaborating with our experts.

VX LP Sequence USE FOR CORPORATE SITE-thumb
Venminder Exchange

As Venminder completes assessments for clients on new vendors, they are then made available inside the Venminder Exchange for you to preview scores and purchase as you need.

CREATE FREE ACCOUNT

Use Cases

Learn more on how customers are using Venminder to transform their third-party risk management programs. 

Industries

Venminder is used by organizations of all sizes in all industries to mitigate vendor risk and streamline processes

Why Venminder

We focus on the needs of our customers by working closely and creating a collaborative partnership

1.7.2020-what-is-a-third-party-risk-assessment-FEATURED
Sample Vendor Risk Assessments

Venminder experts complete 30,000 vendor risk assessments annually. Download samples to see how outsourcing to Venminder can reduce your workload.

DOWNLOAD SAMPLES

Resources

Trends, best practices and insights to keep you current in your knowledge of third-party risk.

Webinars

Earn CPE credit and stay current on the latest best practices and trends in third-party risk management.  

See Upcoming Webinars

On-Demand Webinars

 

Community

Join a free community dedicated to third-party risk professionals where you can network with your peers. 

Weekly Newsletter

Receive the popular Third Party Thursday newsletter into your inbox every Thursday with the latest and greatest updates.

Subscribe

 

Venminder Samples

Download samples of Venminder's vendor risk assessments and see how we can help reduce the workload. 

resources-whitepaper-state-of-third-party-risk-management-2023
State of Third-Party Risk Management 2023!

Venminder's seventh annual whitepaper provides insight from a variety of surveyed individuals into how organizations manage third-party risk today.

DOWNLOAD NOW

FREE TEMPLATE

Third-Party Risk Management
Policy Template

Contains best practice policy content, descriptions, and processes your organization can use as the foundation to customize and align to your own third-party risk management framework.

Download Free Template

Template Highlights

  • Reflects regulatory guidance and best practices in the third-party risk management process
  • Policy template is available as a Microsoft Word editable template document, so it's easy to use and reformat to fit your organization
  • Includes a complementary instructions PDF and a guide PDF to give you further knowledge as you build out your policy
  • Over 19 sections including:
    • A statement of purpose through scope
    • Oversight through reporting expectations
    • Activities through the third-party risk management lifecycle like risk assessment, due diligence, contractual standards, ongoing monitoring, termination, etc.


Template Preview

Preview the text content for this template

Third-Party Risk Management Policy Template

1. Overview and Background

(Company) (hereinafter referred to as (Company)) uses Third Parties to provide products or services in support of our business operations. Such outsourced relationships may benefit (Company) by reducing costs, improved performance, staff augmentation, increased business competitiveness, access to specific expertise, and established distribution channels. However, Senior Management and the Board of Directors recognize that (Company’s) reliance on third-party relationships presents many risks that must be identified, assessed, and managed. Failure to manage these risks can expose (Company) to financial loss, litigation, or other damages or may even impair (Company) ability to service existing customer relationships or establish new ones.

2. Statement of Purpose

This policy aims to establish standards and guidance relating to (Company)’s management of its third-party relationships and the associated inherent and residual risks presented by those third-party relationships. These risks are present when (Company) engages with third parties to provide products and services directly to (Company) for the benefit of its internal operations, employees, investors, or customers. Furthermore, the (Company) documents the structure for; identifying, assessing, controlling, monitoring, and reporting on risks related to (Company)’s use of third parties per applicable laws, safe and sound business practices, and related supervisory guidance, particularly that of the Final Interagency Guidance from the Board of Governors, the FDIC, and the OCC. 

3. Policy Statement

Relationships with third parties are fundamental to (Company)’s ability to maintain its operations and offer products and services to its employees, customers, and investors. However, (Company)’s use of third parties does not diminish its responsibility to ensure that the activity is performed safely and soundly and complies with applicable law, has established the (Policy Name) (hereinafter referred to as the policy), to formally define the framework, tools, roles, responsibilities, scope, and components, needed for a fully functioning Third-Party Risk Management program. The framework shall comply with all applicable laws and regulatory guidelines. Accordingly, this policy sets forth the requirements for the effective identification, assessment, and management of these risks.

4 Terms

4.1 Third Party

The term third party broadly covers similar terms such as vendor, supplier, providers, and the like. The term third party relates to any person, independent consultant, or form of a legal entity, including but not limited to: vendors, service providers, suppliers, processors, business partners, marketers, or other third parties, with whom (Company) contracts for purposes of obtaining products or services, or who collaborate with (Company) in providing products and services in the marketplace.

4.2 Third-Party Risk Management and Oversight

Third-Party Risk Management is the formalized process of identifying, assessing, and mitigating risks presented to (Company), its employees, investors, and customers due to the improper supervision or mismanagement of the following: data, operations, compliance, and financial condition concerning those external parties with whom (Company) has a relationship. The term Third-Party Risk Management (hereinafter referred to as TPRM), is also inclusive of all reporting, governance, and oversight activities necessary to ensure the safe and sound engagement with (Company)’s third parties. 

5. Scope

TPRM applies to all business relationships between a third party and (Company) by contract or otherwise.

All (Company) employees, independent contractors, and consultants are subject to this Policy. As are other entities, engaging third parties for the Company's direct or indirect benefit, third parties with whom they contract.

5.1 Third Parties Not in Scope Under This Policy

The following third-party relationships have been excluded from this Policy.

a)    Relationships with Customers
b)    Relationships with Investors
c)    Relationships with Employees
d)    Relationships with public utility providers
e)    Relationships with emergency services such as police or fire departments
f)    Relationships with government agencies, taxing authorities, regulatory bodies, and courts

5.2 Pre Existing Third-Party Relationships

It is the responsibility of (Company) Senior Management and the Board of Directors to ensure compliance with this Policy regarding third-party relationships maintained by (Company). It is possible that certain existing third-party relationships (and contracts) do not comply with all policy aspects. However, (Company) is obligated to renegotiate, to the extent possible, any contract terms and conditions to existing third-party contracts to comply with this policy and the related processes. Renegotiation shall occur at the first potential and reasonable opportunity (i.e., contract negation.) 

6. Third-Party Risk Management Oversight

Senior Management and the Board are ultimately accountable for the TRPM policy, program, and processes' oversight and effectiveness. Senior Management and the Board of Directors ensure that the TPRM program operates according to applicable federal and state laws, rules, regulations, internal policies, and procedures. They achieve this through the following:

6.1 Policy Management and Approval

Senior Management and the Board initially approve and oversee the Third-Party Risk Management and Oversight Policy and annually review and, if necessary, update the Policy. 

6.2 Approval of Critical Third Parties

Senior Management and the Board, or their designated committee, are responsible for the decision to approve the addition or termination of third-party relationships considered critical to (Company). Such approvals are mandatory in advance of final contract execution with any material third party.

6.3 Periodic Review of Critical Third Parties

Senior Management and the Board or their designated committee shall periodically review third parties considered critical to (Company)'s operations. They must consider the related risk assessments monitoring, compliance, business continuity, financial health, and overall performance of those material third parties. 

6.4 Staffing and Resources

Senior Management shall allocate sufficient qualified staff (internal or augmented) to provide the necessary oversight and monitoring of significant third-party relationships. Sufficient resource capacity is maintained to execute essential TPRM processes effectively, especially those requiring specialized expertise. And to ensure all critical and high-risk rated third-party relationships are assessed, monitored, and managed commensurate with the product or service's risk.

Frequently Asked Questions

What is a third-party risk management policy?

The policy is the first document that should be created and will identify the roles, responsibilities, regulations, and overall purpose of a  program. It also provides a broad outline on the areas of due diligence, risk assessments, contract management, and establishes how the board and senior management will stay informed of vendor management activities. 

Is this template really free?

Yes! We know that this template is valuable (and that many organizations put a price on accessing a template) but, as passionate advocates for better third-party risk management practices, we have decided that there is no better way to assist than by giving third-party risk professionals a helping hand with this customizable template. You still have a lot of work to do to customize and align to your organization, but we are hoping this gets you there faster!

Does this policy allow me to customize it to match what my organization does?

Absolutely, and, we urge you to do so! The template is formatted in a Microsoft Word document so it’s easy to change any aspect. Instructions point out what specially to edit and a guide gives best practices and tips.

Who created this template?

This free policy template was carefully crafted by Venminder’s highly skilled third-party risk professionals who have not only done the job in their own careers, but today advise Venminder's 1,200+ customers, many of whom are subject to the strictest regulatory guidance.