Gain a 360-degree view of third-party risk by using our SaaS software to centralize, track, automate, assess and report on your vendors. 

Managed Services

Let us handle the manual labor of third-party risk management by collaborating with our experts to reduce the workload and mature your program. 

Document Collection
Policy/Program Template/Consulting
Virtual Vendor Management Office
Vendor Site Audit

Ongoing Monitoring

Let us handle the manual labor of third-party risk management by collaborating with our experts.

Venminder Exchange

As Venminder completes assessments for clients on new vendors, they are then made available inside the Venminder Exchange for you to preview scores and purchase as you need.


Use Cases

Learn more on how customers are using Venminder to transform their third-party risk management programs. 


Venminder is used by organizations of all sizes in all industries to mitigate vendor risk and streamline processes

Why Venminder

We focus on the needs of our customers by working closely and creating a collaborative partnership

Sample Vendor Risk Assessments

Venminder experts complete 30,000 vendor risk assessments annually. Download samples to see how outsourcing to Venminder can reduce your workload.



Trends, best practices and insights to keep you current in your knowledge of third-party risk.


Earn CPE credit and stay current on the latest best practices and trends in third-party risk management.  

See Upcoming Webinars

On-Demand Webinars



Join a free community dedicated to third-party risk professionals where you can network with your peers. 

Weekly Newsletter

Receive the popular Third Party Thursday newsletter into your inbox every Thursday with the latest and greatest updates.



Venminder Samples

Download samples of Venminder's vendor risk assessments and see how we can help reduce the workload. 

State of Third-Party Risk Management 2023!

Venminder's seventh annual whitepaper provides insight from a variety of surveyed individuals into how organizations manage third-party risk today.



Fundamental Third-Party Risk Management Best Practices

CPE Credit Eligible

Let's talk best practices.

We'll discuss fundamentals to third party risk management such as education, tailored ongoing monitoring, outsourcing and not cutting corners.

Available on
Listen-on-Apple-Podcasts-badge.jpg  google-play-badge 2.jpg

Podcast Transcript

Branan_Cooper_2017_circle.jpgWelcome to this week’s Third Party Thursday! My name is Branan Cooper and I’m the Chief Risk Officer here at Venminder.

Stay Educated

Let’s talk about some best practices. First, stay educated – read a lot and study interpretations – such as the legal analysis or industry publications or even less common places like Twitter or LinkedIn often turn up interesting nuggets of information.

Stay ahead of the curve as best you can and invite others to be involved – meet regularly with subject matter experts, and ask for input from audit and counsel. 

One conference that I attended last year in Washington, DC  was a day long financial services forum with the regulators  specifically on third party risk management. It was good to have a chance to hear directly from them on what they expect, where their concerns lie and we even had the opportunity to submit anonymously questions in advance.

While they certainly provide a long disclaimer on how what they are discussing is a matter of stated opinion and should not be interpreted as new guidance, it does give outstanding insight into what may be areas that you need to further consider in your own institution. I have seen more and more conferences solely focused on third party risk popping up out there.

Tailor Your Ongoing Monitoring Based On Service Type Or Risk Level

Tailor your ongoing monitoring to the type of service provided and the level of risk – call centers and statement production facilities require far different types of oversight.

Watch social media carefully – what are your customers saying – what may be causing potential concerns – direct them out of social media and address them in a more confidential manner but also look and see if it is a leading indicator of bigger problems.

We also set up sophisticated monitoring of our third parties with queries looking for the name of the third party in conjunction with various terms like “enforcement action”, breach, complaint, that might indicate a concern so we could promptly investigate.

It is a real challenge to stay abreast of it but you will not believe how many times we’ve headed off major problems by reacting to an early warning sign. Also, since the CFPB has made it their mandate since day one to have a complaints protocol, you really need to look and be prepared to address items proactively. It usually takes dedicated effort and an automated solution.

I’d also suggest simple steps like checking out new third parties reputation by looking at their Better Business Bureau rating or go to RipOff and absolutely do a regular Google news search on them.

Consider a Second Review With an Independent Expert

Some other best practices...particularly when it comes to some of the more complicated analysis of business continuity and cybersecurity reviews – it’s expensive to hire that sort of talent, you will often find it’s better to hire as needed an outside consultant rather than add a new employee to your staff, particularly if you don’t need them on a regular basis or if your overall organization devoted to information technology or information security is limited on resources.

Consider a second set of eyes approach (or a four eyes approach as I’ve heard it referred to in Europe) – that basically means getting a second review of an item. While that may seem like a duplication of efforts, there is a great deal of value in getting an independent objective outside opinion on complicated matters just to make sure you haven’t missed anything. Again, make sure the effort is documented and you note the qualifications of the independent party to conduct such a review.

Automated solutions cut down on work and re-work and reduce the propensity for errors. I’ve known many companies that do all of their vendor management on excel spreadsheets, but that just doesn’t feel sustainable, particularly when guidance changes and you’d in theory need to go in and re-do hundreds of spreadsheets. 

Don’t Cut Corners

Don’t cut corners – sounds easy but believe me, it is tempting, when workloads are high or time constraints exist, particularly if you’re a one person team trying to do third-party risk management as just one component of a larger compliance program. Unfortunately, that’s when mistakes get made or facts get overlooked. 

The time and effort you put into a third-party risk program pays off in many ways – cutting corners can cause it to all fall apart and thus expose your bank and its customers to undue risk. This was always one of the things that kept me up at night, quite frankly, making sure we weren’t just rushing through things for the sake of time or efficiency – I’d like to think that I generally had the consumer’s best interests in mind while also protecting the financial institution. 

There are certainly times where you get pressured on deadlines or have to make exceptions – the only advice I have there is what I always firmly believe is the role of the second line of defense. Analyze the situation, limit the occurrences, document the possible consequences and escalate and communicate the concerns. Ultimately, sometimes you can’t control a situation but you can advise them how bad it might hurt if the worst case scenario plays out. 

Again, I’m Branan and thank you for watching! Don’t forget to subscribe to the Third Party Thursday series.


Subscribe to our Third Party Thursday Newsletter

Receive weekly third-party risk management news, resources, and more to your inbox.


New Call-to-action

Ready to Get Started?

Schedule a personalized solution demonstration to see how Venminder can transform your vendor risk management processes.

Request a Demo