Inventory and classification
We make relationships and dependencies traceable as a basis for assessment.
- Capture services and data access
- Map owners and connected parties
- Agree criteria with specialists
- Deliver an inventory with information gaps
Third-Party Risk Management: Inventory and Assess Relationships
We establish a traceable assessment process for third parties.
- 01Inventory relationships and service scope
- 02Define classification and evidence
- 03Pilot assessment and approval
- 04Map changes and termination
- 05Hand over the process and open evidence
11+Years of experience
120+Employees
540+Projects
ISO 27001certified
Third-Party Risk Management: Inventory and Assess Relationships
The focus is the relationship inventory and risk-based assessment through onboarding, change and termination. Classification determines the information and checks required. A questionnaire or tool alone does not establish a completed assessment.
3 service modules
Service scope
Assessment and decision
We connect assessment to suitable evidence and governed approvals.
- Define review scope for each relationship
- Distinguish evidence from self-assessments
- Document conditions and exceptions
- Provide justified decision records
Process integration
We turn assessments into repeatable onboarding, change and closure workflows.
- Clarify handover to vendor oversight
- Define change and reassessment triggers
- Test data and tool handoffs
- Deliver process instructions and open actions
5 phases
Our Approach
We define the data model, assessment criteria and responsibilities using selected relationships. The pilot follows a case from intake through evidence and decision to handover into ongoing oversight. Missing information and accepted limitations are documented.
Inventory relationships and service scope
Define classification and evidence
Pilot assessment and approval
Map changes and termination
Hand over the process and open evidence
Your contact
Sarah Richter
Head of Information Security, Cyber Security
10+ years of experience, CISA, CISM, Lead Auditor, DORA, NIS2, BCM, Cyber and Information Security
Systematic third-party management is the key to secure and sustainable business relationships. Those who effectively manage and monitor their third parties minimize risks and create long-term value.
6 QUESTIONS, BRIEFLY ANSWERED
Frequently asked questions about Third-Party Risk Management: Inventory and Assess Relationships
What is the concrete project scope?
A relationship inventory, agreed assessment criteria and a tested decision process. We distinguish it from ongoing performance oversight, which receives the results and feeds back subsequent changes.
How are regulatory requirements mapped?
Applicability is established for the organisation, service and relationship with accountable specialists. DORA addresses ICT third-party risk within its scope; that does not make every supplier relationship equivalent or establish an automatic compliance assurance.
How is assessment effort determined?
Service importance, data access, substitutability and known dependencies inform justified criteria. Missing information remains visible; a numerical score replaces neither business judgement nor approval.
Which evidence is assessed?
Requirements follow agreed criteria and may include service descriptions, contracts, security evidence and subcontractor information. Statements are assessed for scope and currency; unavailable evidence is treated as a gap.
When is a relationship reassessed?
We agree scheduled reviews and relevant triggers such as new services, data access or subcontractors. The workflow identifies owners and decision consequences; one fixed frequency is not appropriate for every relationship.
How is the process integrated with existing GRC tools?
We map fields, owners, states and evidence references before implementing handoffs. A pilot tests intake, approval, updates and closure. A successful import does not establish complete data or effective risk decisions.
