# Third Party Risk Management (TPRM) > Swiss GRC beschreibt das TPRM-Modul der SwissGRC® Platform. Es unterstützt Unternehmen, Finanzinstitute und weitere Organisationen dabei, Lieferanten und Dienstleister über den gesamten Lebenszyklus von der Aufnahme bis zum Exit zu erfassen, zu bewerten und zu überwachen. - URL: https://swissgrc.com/en/tprm-software/ - Publisher: SwissGRC® - Published: 2025-06-11 - Last updated: 2026-10-07 ## Key facts - Das TPRM-Modul der SwissGRC® Platform deckt den gesamten Lebenszyklus ab, von der Aufnahme über Bewertung, Überwachung und Reporting bis zu Massnahmen und Exit. - Dienstleister, Services, Verträge, Risiken und Kontrollen werden in einem Register verknüpft, und Bewertungen haben Fälligkeiten, Workflow und Nachweise. - Der Lebenszyklus gliedert sich in fünf Schritte und neun Phasen, jede Phase mit Verantwortlichem, Fälligkeit und einem prüfbaren Ergebnis. - Externe Datenquellen wie SecurityScorecard, BitSight, Prospero und Synesgy von CRIF liefern Signale für die laufende Überwachung der Dritten. - Das Modul verweist auf regulatorische Erwartungen an das Outsourcing, darunter DORA Art. 28 bis 30, FINMA-RS 2018/3, EBA-Leitlinien und ISO/IEC 27036. - Das Third-Party Intelligence Center prüft jeden Dritten auf Sanktionen, PEP und negative Medienberichte und eskaliert nur bei einem Signal zu vertiefter Due Diligence. Third-Party Risk Management # You know your third parties. Do you know your dependencies? Inventory your suppliers and service providers, tier them by criticality, monitor them continuously and report with evidence: Swiss GRC makes your third-party risk manageable. **Across the entire lifecycle**, from intake to exit. Request Demo See how it works Trusted by leading organizations What matters ## From a supplier list to a portfolio you can steer Every organization has a register of contracts. What sets them apart is whether it turns into a risk picture that still holds today. The common starting point ### Contracts known, risks estimated Service providers sit in spreadsheets, questionnaires come back by mail, reviews happen at contract renewal. Who depends on whom only shows in an outage. - Supplier list in spreadsheets, services not assigned - Questionnaires by mail, answers without evidence - Assessment at intake, no reassessment after - Concentrations and subcontractors invisible With the SwissGRC® Platform ### A register that keeps up Service providers, services, contracts, risks and controls hang together. Assessments have due dates, external signals come in, findings become actions. - Service providers and services linked in one register - Assessments with workflow, due date and evidence - Continuous monitoring instead of a snapshot - Critical outsourcings evidenced at any time How it works ## Five steps, one closed loop From the first request to the action, and from there back into the next assessment. Pick a step. Continuous, not one off 01*/05* Onboarding and recording *Phases*Scoping*·*Identification*·*Outsourcing classification ### Every third party recorded, every service assigned Suppliers, service providers and their services enter the register through a guided request path. Tiering by service category, region and criticality happens along the way, not months later. See all phases 1. Central inventory of service providers and services 2. Guided request and approval path 3. Scoping and identification 4. Outsourcing classification 5. Linked to contracts and owners 6. Import of existing supplier lists 02*/05* Assessment and classification *Phases*Risk analysis*·*Due diligence ### From inherent risk to evidenced criticality Security, compliance, business continuity and financial stability in one questionnaire set. The answers produce a risk profile per service provider and per service, not just per contract. See all phases 1. Risk analysis and assessment 2. Comprehensive due diligence 3. Questionnaires with self attestation by the provider 4. Assessment per service and per provider 5. Critical outsourcings identified 6. Linked to risks and controls 03*/05* Continuous monitoring *Phases*Monitoring*·*Contract management ### The risk status does not age External signals and internal deadlines come together. If a provider's cyber rating, sanctions picture or financial position changes, the register raises it itself. See the screening 1. Continuous review of the risk status 2. External data sources connected 3. Alerts on critical changes 4. Recurring reassessments by risk tier 5. Contract terms and deadlines in view 6. Reassessments scheduled and documented 04*/05* Automated reporting *Phases*Reporting*·*Analysis ### Audit ready without a preparation week Portfolio, concentrations and critical outsourcings in one analysis. What supervisors want to see is already collected, not still to be assembled. Look inside the product 1. Dashboards on performance and risk 2. Analyses for supervisors and audit 3. View of concentrations and dependencies 4. Register of information on critical outsourcings 5. Reporting per unit and per provider 6. Evidence with date and person 05*/05* Actions and exit *Phases*Actions*·*Exit and transition planning ### Findings turn into action Every finding leads to an action with an owner and a due date. And when a relationship ends, the exit is planned before it is needed. Request Demo 1. Actions with owner and due date 2. Automatic task assignment 3. Escalation when overdue 4. Exit and transition planning 5. Alternatives and dependencies documented 6. Effectiveness of actions evidenced Inside the product ## What you see first in the morning No click path through menus, three views that answer the state of your third-party portfolio in seconds. ![Views from the TPRM module of the SwissGRC Platform: risk dashboard, service catalogue and criticality rating](https://swissgrc.com/wp-content/uploads/2025/04/Isometric-screenshots-net-background.png) 01 #### Portfolio at a glance Number of critical providers, distribution of risk classes and open reviews, aggregated across the whole register. 02 #### Services, not just providers The register shows which service depends on which provider and which business process depends on it. 03 #### Criticality and compliance Status, criticality and compliance rating side by side per service, filterable by unit and region. Connected to **external data sources** so that assessments do not rest on self declaration alone. Signals from these sources feed the monitoring of your third parties. ![Prospero](https://swissgrc.com/wp-content/uploads/2025/07/Prospero-Logo-pos-rgb.png) Predictive analytics and decision support on an AI basis. ![SecurityScorecard](https://swissgrc.com/wp-content/uploads/2025/04/SecurityScorecard.png) Systematic rating of the cyber security posture of service providers. ![BitSight](https://swissgrc.com/wp-content/uploads/2025/07/Bitsight-Logo.png) Analysis and rating of cyber risk from external signals. ![Synesgy von CRIF](https://swissgrc.com/wp-content/uploads/2023/12/criflogo.png) Synesgy by CRIF, specialized in ESG ratings of companies. The lifecycle in detail ## Nine phases, nine evidenced outputs The five steps break down into nine phases. Each has an owner, a due date and an output that can be put in front of an auditor. Stage 1 . phases 01 to 03 Intake and scoping Who is even in the picture? 1. #### Inventory of third parties and services Suppliers, service providers and their services recorded centrally and linked to owners, contracts and their associated risks. *Output***Register of providers and services**, reportable at any time 2. #### Scoping and identification Define the scope of third-party risk management and identify the relevant providers and services. *Output***Documented scope** with a rationale 3. #### Outsourcing classification Categorize outsourcings and separate material from non material against documented criteria. *Output***Materiality assessment** per outsourcing Stage 2 . phases 04 to 06 Assessment and contract How big is the risk really? 1. #### Risk analysis and assessment Determine the risk profile per provider and per service, inherent and after the effect of the agreed controls. *Output***Gross and net risk profile** per service 2. #### Comprehensive due diligence Review business practice, compliance and security standards of your providers, with questionnaire, evidence and approval. *Output***Due diligence file** with evidence 3. #### Contract management Monitor contract terms, notice periods and agreed obligations and spot gaps early. *Output***Contract overview** with deadlines and obligations Stage 3 . phases 07 to 09 Operation and termination Does it stay under control? 1. #### Continuous monitoring Keep the risk status current, take in external signals and react on deviations instead of at renewal. *Output***Current risk status** and the alerts it raised 2. #### Reporting and analysis Provider performance and risk in dashboards, tailored to the unit, to internal audit and to the board. *Output***Board and supervisory report** on demand 3. #### Exit and transition planning Plan exits in a structured way, document alternatives and run transitions without interrupting processes. *Output***Exit plan** with transition steps and alternatives Built on the **regulatory expectations for outsourcing**, from the materiality test through to the evidence. DORA Art. 28 to 30 FINMA circ. 2018/3 EBA guidelines ISO/IEC 27036 Third-Party Intelligence Center AI powered screening for your entire register Broad coverage, targeted depth: the Intelligence Center screens every third party for sanctions, PEP and adverse media and escalates to deeper due diligence only where a signal justifies it. **Tier 1**Quick scan **Tier 2**Twelve risk categories **Tier 3**Network and fourth parties [See the Intelligence Center](https://swissgrc.com/en/third-party-intelligence/) Who benefits ## Who our TPRM module makes the difference for Third-party risk concerns several functions at once. Every role sees its own view, all work on the same register and ask the same question only once. #### Compliance Monitor sanctions and anti bribery requirements per provider and avoid risky business relationships before they start. #### ESG Take environmental, social and governance criteria into the supplier assessment and track changes through external sources. #### Procurement and supplier management Speed up intake of new suppliers with a risk assessment and monitor existing ones for changes that hit the supply chain. #### Cyber security and data protection Check the security posture of ICT service providers against your requirements, spot weaknesses and control data flows to third parties. #### Operational resilience Assess third-party risk to critical functions and evidence that critical providers have workable continuity plans. #### Internal audit and the board See critical outsourcings, concentrations and open findings without a special analysis, always on the same status. Advantages and benefits ## Less effort per provider, more overview across all The module takes the recurring work out of the process and leaves the judgement with you. - **Critical third parties spotted early**Materiality and criticality come out of the classification, not out of a gut feeling in individual units. - **Assessments without email traffic**Questionnaires run as a workflow, with reminders, escalation and a documented answer instead of attachments in an inbox. - **Monitoring instead of a snapshot**Recurring reassessments by risk tier and signals from external sources keep the status current. - **Dependencies become visible**Concentrations on single providers, regions or subcontractors surface in the portfolio, not in the incident. - **Evidence on demand**Assessment, approval and review are recorded with date, person and evidence and produced in minutes. - **One process for every function**Compliance, procurement, security and resilience work on the same register without asking the same question twice. Contact and demo ## We show you the TPRM module live In a personal demo we walk you through the entire lifecycle: onboarding, classification, due diligence, monitoring, reporting and exit. On one end to end example from practice, with no preparation needed on your side. [Request Demo](https://swissgrc.com/en/demo) [Contact Sales](https://swissgrc.com/en/sales) ## Frequently asked questions ### Was ist das TPRM-Modul von Swiss GRC? Es ist ein Modul der SwissGRC® Platform für das Management von Drittparteirisiken. Es erfasst Lieferanten und Dienstleister samt Services, stuft sie nach Kritikalität ein, überwacht sie laufend und erstellt Berichte mit Nachweisen. ### Welche Phasen umfasst das Third Party Risk Management bei Swiss GRC? Es gibt neun Phasen: Inventar, Scoping und Identifikation, Outsourcing-Klassifizierung, Risikoanalyse, Due Diligence, Vertragsmanagement, laufende Überwachung, Reporting und Analyse sowie Exit- und Transitionsplanung. Jede Phase liefert ein dokumentiertes Ergebnis. ### Wie werden Dienstleister laufend überwacht? Externe Signale und interne Fristen werden zusammengeführt. Ändern sich Cyber-Rating, Sanktionslage oder Finanzlage eines Dienstleisters, meldet das Register dies selbst, zudem gibt es wiederkehrende Neubewertungen nach Risikostufe. ### Welche regulatorischen Vorgaben berücksichtigt das TPRM-Modul? Die Seite nennt DORA Art. 28 bis 30, FINMA-RS 2018/3, die EBA-Leitlinien und ISO/IEC 27036. Das Modul stützt sich auf die Erwartungen an das Outsourcing, von der Wesentlichkeitsprüfung bis zum Nachweis. ### Welche Funktionen im Unternehmen nutzen das TPRM-Modul? Genannt werden Compliance, ESG, Einkauf und Lieferantenmanagement, Cyber Security und Datenschutz, Operational Resilience sowie Interne Revision und Verwaltungsrat. Alle arbeiten im selben Register, jede Rolle mit eigener Sicht.