DE
FR
IT
العربيةYou know your third parties.
Do you know your dependencies?
Inventory your suppliers and service providers, tier them by criticality, monitor them continuously and report with evidence: Swiss GRC makes your third-party risk manageable. Across the entire lifecycle, from intake to exit.
Trusted by leading organizations
From a supplier list
to a portfolio you can steer
Every organization has a register of contracts. What sets them apart is whether it turns into a risk picture that still holds today.
Contracts known, risks estimated
Service providers sit in spreadsheets, questionnaires come back by mail, reviews happen at contract renewal. Who depends on whom only shows in an outage.
- Supplier list in spreadsheets, services not assigned
- Questionnaires by mail, answers without evidence
- Assessment at intake, no reassessment after
- Concentrations and subcontractors invisible
A register that keeps up
Service providers, services, contracts, risks and controls hang together. Assessments have due dates, external signals come in, findings become actions.
- Service providers and services linked in one register
- Assessments with workflow, due date and evidence
- Continuous monitoring instead of a snapshot
- Critical outsourcings evidenced at any time
Five steps,
one closed loop
From the first request to the action, and from there back into the next assessment. Pick a step.
Every third party recorded, every service assigned
Suppliers, service providers and their services enter the register through a guided request path. Tiering by service category, region and criticality happens along the way, not months later.
See all phases- Central inventory of service providers and services
- Guided request and approval path
- Scoping and identification
- Outsourcing classification
- Linked to contracts and owners
- Import of existing supplier lists
From inherent risk to evidenced criticality
Security, compliance, business continuity and financial stability in one questionnaire set. The answers produce a risk profile per service provider and per service, not just per contract.
See all phases- Risk analysis and assessment
- Comprehensive due diligence
- Questionnaires with self attestation by the provider
- Assessment per service and per provider
- Critical outsourcings identified
- Linked to risks and controls
The risk status does not age
External signals and internal deadlines come together. If a provider's cyber rating, sanctions picture or financial position changes, the register raises it itself.
See the screening- Continuous review of the risk status
- External data sources connected
- Alerts on critical changes
- Recurring reassessments by risk tier
- Contract terms and deadlines in view
- Reassessments scheduled and documented
Audit ready without a preparation week
Portfolio, concentrations and critical outsourcings in one analysis. What supervisors want to see is already collected, not still to be assembled.
Look inside the product- Dashboards on performance and risk
- Analyses for supervisors and audit
- View of concentrations and dependencies
- Register of information on critical outsourcings
- Reporting per unit and per provider
- Evidence with date and person
Findings turn into action
Every finding leads to an action with an owner and a due date. And when a relationship ends, the exit is planned before it is needed.
Request Demo- Actions with owner and due date
- Automatic task assignment
- Escalation when overdue
- Exit and transition planning
- Alternatives and dependencies documented
- Effectiveness of actions evidenced
What you see first
in the morning
No click path through menus, three views that answer the state of your third-party portfolio in seconds.
Portfolio at a glance
Number of critical providers, distribution of risk classes and open reviews, aggregated across the whole register.
Services, not just providers
The register shows which service depends on which provider and which business process depends on it.
Criticality and compliance
Status, criticality and compliance rating side by side per service, filterable by unit and region.
Predictive analytics and decision support on an AI basis.
Systematic rating of the cyber security posture of service providers.
Analysis and rating of cyber risk from external signals.
Synesgy by CRIF, specialized in ESG ratings of companies.
Nine phases,
nine evidenced outputs
The five steps break down into nine phases. Each has an owner, a due date and an output that can be put in front of an auditor.
-
Inventory of third parties and services
Suppliers, service providers and their services recorded centrally and linked to owners, contracts and their associated risks.
OutputRegister of providers and services, reportable at any time -
Scoping and identification
Define the scope of third-party risk management and identify the relevant providers and services.
OutputDocumented scope with a rationale -
Outsourcing classification
Categorize outsourcings and separate material from non material against documented criteria.
OutputMateriality assessment per outsourcing
-
Risk analysis and assessment
Determine the risk profile per provider and per service, inherent and after the effect of the agreed controls.
OutputGross and net risk profile per service -
Comprehensive due diligence
Review business practice, compliance and security standards of your providers, with questionnaire, evidence and approval.
OutputDue diligence file with evidence -
Contract management
Monitor contract terms, notice periods and agreed obligations and spot gaps early.
OutputContract overview with deadlines and obligations
-
Continuous monitoring
Keep the risk status current, take in external signals and react on deviations instead of at renewal.
OutputCurrent risk status and the alerts it raised -
Reporting and analysis
Provider performance and risk in dashboards, tailored to the unit, to internal audit and to the board.
OutputBoard and supervisory report on demand -
Exit and transition planning
Plan exits in a structured way, document alternatives and run transitions without interrupting processes.
OutputExit plan with transition steps and alternatives
Broad coverage, targeted depth: the Intelligence Center screens every third party for sanctions, PEP and adverse media and escalates to deeper due diligence only where a signal justifies it.
Who our TPRM module
makes the difference for
Third-party risk concerns several functions at once. Every role sees its own view, all work on the same register and ask the same question only once.
Compliance
Monitor sanctions and anti bribery requirements per provider and avoid risky business relationships before they start.
ESG
Take environmental, social and governance criteria into the supplier assessment and track changes through external sources.
Procurement and supplier management
Speed up intake of new suppliers with a risk assessment and monitor existing ones for changes that hit the supply chain.
Cyber security and data protection
Check the security posture of ICT service providers against your requirements, spot weaknesses and control data flows to third parties.
Operational resilience
Assess third-party risk to critical functions and evidence that critical providers have workable continuity plans.
Internal audit and the board
See critical outsourcings, concentrations and open findings without a special analysis, always on the same status.
Less effort per provider,
more overview across all
The module takes the recurring work out of the process and leaves the judgement with you.
- Critical third parties spotted earlyMateriality and criticality come out of the classification, not out of a gut feeling in individual units.
- Assessments without email trafficQuestionnaires run as a workflow, with reminders, escalation and a documented answer instead of attachments in an inbox.
- Monitoring instead of a snapshotRecurring reassessments by risk tier and signals from external sources keep the status current.
- Dependencies become visibleConcentrations on single providers, regions or subcontractors surface in the portfolio, not in the incident.
- Evidence on demandAssessment, approval and review are recorded with date, person and evidence and produced in minutes.
- One process for every functionCompliance, procurement, security and resilience work on the same register without asking the same question twice.
We show you
the TPRM module live
In a personal demo we walk you through the entire lifecycle: onboarding, classification, due diligence, monitoring, reporting and exit. On one end to end example from practice, with no preparation needed on your side.
