Vendor & Third-Party Risk
Vendor audit + TPRM
on the same engagement model
Vendor onboarding due diligence, SOC 1 / SOC 2 reliance, ongoing monitoring, breach response — backed by Vendor SOC 2 Ingest (an AI parser that pulls a SOC 2 report into the controls library) and Continuous Risk Assessment that re-scores third parties as evidence lands.
Vendor onboarding & DD
- Vendor risk register with tier-based DD
- Questionnaire library (CAIQ, SIG, custom)
- Vendor SOC 2 Ingest — AI parses SOC 1 / SOC 2 PDFs
- DPIA + DPA tracker for GDPR / EU AI Act vendors
SOC 1 / SOC 2 reliance
- CUEC tracker linked to user-entity controls
- Sub-service organisation flow tracking
- Bridge-letter capture between report periods
- Reliance memo auto-drafted from ingested SOC report
Continuous third-party monitoring
- AI agents re-score vendors on new evidence
- Breach-incident workflow + obligations register
- Concentration-risk reporting across vendors
- DORA ICT-third-party register for EU regulated firms
Vendor audit engagements
- Engagement subtype tagged 'External Audit' / 'Operational'
- Right-to-audit evidence collection
- Findings shared with vendor via Auditor Portal
- Vendor remediation SLA tracker
Audit the vendors, not just the spreadsheet
Vendor SOC 2 Ingest + Continuous Risk Assessment + DORA register on the GRC Enterprise tier.