[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-381721-105":53,"doc-detail-381721-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","framework-for-a-third-party-risk-management-program-third-party-risk-management-program-overview","Framework for a Third Party Risk Management Program - Third Party Risk Management Program Overview","","Framework for a Third Party Risk Management Program presents a structured approach to building requirements for a modern, dynamic third-party risk management solution. It divides program delivery into initial setup and ongoing monitoring. The initial setup covers identifying third-party risks, defining monitoring policies and procedures, consolidating third-party profiles and contracts into a single repository, closing critical data gaps, and conducting an initial risk assessment with risk scoring and classification.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/framework-for-a-third-party-risk-management-program-third-party-risk-management-program-overview/381721/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/framework-for-a-third-party-risk-management-program-third-party-risk-management-program-overview/381721.png","ImageObject",442,249,{"name":88,"@type":89},"CatatanPagi","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-23","2026-09-24",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",9,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"What are the two main stages in the proposed third-party risk management process?","Question",{"text":109,"@type":110},"The program is divided into initial setup and ongoing monitoring of the third-party risk management program.","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"What does the initial setup focus on?",{"text":114,"@type":110},"It focuses on identifying third-party risks, defining monitoring policies and procedures, consolidating third-party data and contracts into a single repository, closing critical missing-data gaps, and conducting an initial risk assessment.",{"name":116,"@type":107,"acceptedAnswer":117},"How is the initial risk assessment intended to be performed?",{"text":118,"@type":110},"It should assign risk classifications to vendors and can be done via manual classification, questionnaires with scoring, or more robust scoring using a risk matrix with weighted factors.","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},381721,1791732180,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":130,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":101,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":76},962090894170,"https://ap-avatar.wpscdn.com/davatar_6f874abed73319feea01a86fa6f0fab8","Framework for a Third Party Risk Management Program  \nGet a clearer picture of the risks posed by vendors and third parties  \nFramework for a Third Party Risk Management Program  \nIn this paper we outline the key steps that you will need to take when constructing your requirements for a modern and dynamic third party risk management solution. A proposed framework to implement your program is presented for your review.  \nWhen designing a third party risk management program, it is proposed to divide the process into two distinct stages:  \n1. Initial setup of the Third Party Risk Management program  \n2. The ongoing monitoring of the Third Party Risk Management program  \nInitial setup  \nThe initial setup of the program is focused on:  \n1.1 Identifying the risks created by your firm’s use of third parties  \n1.2 Defining your policies and procedures for monitoring third parties  \n1.3 Consolidating your existing third party profile data and contracts into a single data repository  \n1.4 Closing critical gaps on missing data on your third parties  \n1.5 Conducting an initial risk assessment  \nThe initial setup should also consider: (a) the due diligence processes to be undertaken based on the risk classification,(b) the approval and review processes and (c) the implementation of processes to capture and manage any issues.  \n1.1 Identifying the risks created by your firm’s use of by your third parties  \nIdentifying and defining the risks represented by your third parties is the first step in your third party risk management program. This process should involve identifying the scope of your risk management program including the risks you should be monitoring and the types of third party you should be assessing.  \n1.2 Define your policies and procedures for monitoring third parties  \nThe first step with any monitoring program is likely to be an updated definition of your policies and procedures and to obtain all internal approvals. These policies and procedures at a minimum need to include the following:  \n- Roles and responsibilities  \n- Risk assessment process  \n- Due diligence in selecting a third party  \n- Ongoing monitoring  \n- Third party onboarding  \n- Third party termination  \n- Oversight and escalation  \n1.3 Consolidate your existing internal third party profile data and contracts into a single data repository  \nOne of the principal challenges initiating the process to more effectively manage your third parties is the probable dispersion of third party data across the firm. This is exacerbated if there are multiple divisions, departments, countries and if they are stored in multiple data repositories. For effective program management, these sources all need to be assembled into a single integrated operating platform to enable you manage your program effectively. Although you can aggregate the existing internal third party data manually, you should consider how a third party vendor risk management solution may be able to help with aggregating the data:  \n- Does the solution enable you to easily capture the data elements from existing data sources?  \n- Does the functionality of the system have the capability for effective workflow processes to capture the data from internal sources e.g. questionnaires, data entry forms and data entered by the third party itself?  \n- Does the solution allow for the capture of data through integrated feeds from existing external data e.g. third party files on your internal databases, to ensure an easier and more precise transfer from existing systems to your new system?  \n- How flexible are those capabilities at meeting the needs of your data gathering exercise?  \n- Can the data you have aggregated about the third parties be easily queried, filtered and reported on?  \n1.4 Closing critical gaps on missing data on your third parties  \nIt is highly probable that you will not have all the data you need from internal sources to conduct your risk assessment on the third parties. You will need to be sure tha","cbCaihzNcEJZkHtL","https://ap.wps.com/l/cbCaihzNcEJZkHtL","pdf",920663,"English","# Initial setup of the Third Party Risk Management program\n## Identifying third-party risks\n## Defining policies and procedures for monitoring\n## Consolidating third-party data into a repository\n## Closing data gaps for risk assessment\n## Conducting initial risk assessment with scoring and classification\n# Ongoing monitoring of the Third Party Risk Management program","[{\"question\":\"What are the two main stages in the proposed third-party risk management process?\",\"answer\":\"The program is divided into initial setup and ongoing monitoring of the third-party risk management program.\"},{\"question\":\"What does the initial setup focus on?\",\"answer\":\"It focuses on identifying third-party risks, defining monitoring policies and procedures, consolidating third-party data and contracts into a single repository, closing critical missing-data gaps, and conducting an initial risk assessment.\"},{\"question\":\"How is the initial risk assessment intended to be performed?\",\"answer\":\"It should assign risk classifications to vendors and can be done via manual classification, questionnaires with scoring, or more robust scoring using a risk matrix with weighted factors.\"}]","Framework for a Third Party Risk Management Program - Third Party Risk Management Program Overview | PDF",1790246715]