TPRM (Third-Party Risk Management) is the practice of identifying, assessing, and continuously monitoring the risks an organization inherits from vendors, contractors, and service providers. It covers security, privacy, operational, financial, and regulatory risk. Most programs start with security and expand outward.
What's actually inside a TPRM program?
A working TPRM program has four moving parts that map to the vendor lifecycle, and most teams do the first one well and the other three poorly.
- Pre-contract due diligence covers security questionnaires (typically the SIG from Shared Assessments or the CAIQ from the Cloud Security Alliance), SOC 2 review, and penetration test attestations
- Ongoing monitoring covers re-assessment on contract renewal, security-rating feeds, and control monitoring
- Incident coordination is knowing which vendors touch which data when something goes wrong
- Offboarding is deprovisioning access and proving the vendor deleted your data
How is TPRM different from VRM?
TPRM and VRM often get used interchangeably, but TPRM is broader: it covers fourth-party risk and the regulatory obligations your vendors inherit.
The practical reason this matters: regulations like the EU's DORA, in force since January 2025, require financial firms to track ICT risk down through the third-party chain rather than only at the immediate-vendor boundary.
Why does TPRM keep showing up in security questionnaires?
Because the buyer is doing TPRM on you in real time, and the questionnaire is the artifact of their pre-contract due diligence cycle on your company.
We see most teams over-invest in answering questionnaires perfectly and under-invest in the continuous-monitoring side that buyers will exercise on every contract renewal.
Related terms
These adjacent definitions frame the TPRM workflow, with each one connecting an assessment artifact or risk concept to the vendor-review motion.
- SIG is the Standard Information Gathering questionnaire, the one most TPRM teams send first
- CAIQ is the Consensus Assessments Initiative Questionnaire, the cloud-vendor counterpart from the Cloud Security Alliance
- Inherent vs residual risk distinguishes what the vendor brings in the door from what's left after their controls
- Fourth-party risk covers the risk introduced by your vendors' vendors, increasingly required to track under DORA and similar regulations