Governance, Risk & Compliance
Third-Party Risk Management (TPRM)
A five-day programme covering the full third-party risk lifecycle, from inventory and risk tiering to due diligence, contract controls, monitoring, and exit planning for vendors, suppliers, and partners.
Introduction
The Third-Party Risk Management (TPRM) Training Course builds the skills needed to manage the risks that vendors, suppliers, contractors, and partners bring into an organisation. Outsourcing, cloud services, and complex supply chains expand reach, yet they also transfer risk beyond direct control. This course explains how to identify third parties, assess their risk, and set proportionate controls across the full relationship lifecycle. Furthermore, it covers regulatory expectations, due diligence, contract clauses, monitoring, and exit planning. As a result, participants learn to protect operations, data, and reputation while keeping the business benefits of external partnerships intact.
Third-Party Risk Management (TPRM) Course Objectives
- Explain the core concepts and business case for third-party risk management.
- Identify and inventory third parties across all business functions.
- Classify third parties by criticality, data access, and regulatory exposure.
- Apply risk assessment methods using likelihood, impact, and inherent versus residual risk.
- Design due diligence and onboarding processes proportionate to risk tier.
- Align TPRM practice with ISO 31000 and the COSO internal control framework.
- Map TPRM controls to NIST SP 800-161 supply chain risk practices.
- Build contract clauses covering data protection, SLAs, audit rights, and termination.
- Monitor third-party performance using KPIs, KRIs, and continuous monitoring tools.
- Prepare exit strategies, concentration risk reviews, and board-level TPRM reporting.
Course Methodology
- Interactive lectures with cross-industry third-party risk case studies.
- Workshop exercises on tiering, questionnaires, and due diligence files.
- Simulated vendor reviews and risk committee decisions.
- Templates for risk registers, scorecards, and monitoring dashboards.
- Structured peer discussion with facilitator feedback on live TPRM challenges.
Who Should Take This Course
- Risk managers and enterprise risk officers.
- Procurement and supplier management professionals.
- Compliance, legal, and contract specialists.
- Information security and data privacy officers.
- Internal auditors reviewing third-party controls.
- Operations and vendor relationship managers.
Third-Party Risk Management (TPRM) Course Outlines
Foundations of Third-Party Risk Management
- • Core TPRM concepts, terminology, and business drivers.
- • Third-party categories: vendors, suppliers, contractors, and partners.
- • The TPRM lifecycle: identify, assess, contract, monitor, and exit.
- • The three lines model applied to third-party risk.
- • Regulatory expectations and outsourcing rules.
- • Governance roles, policies, and TPRM frameworks.
- • Case study: a third-party failure and its organisational impact.
Identification, Inventory, and Risk Tiering
- • Building and maintaining a third-party inventory.
- • Data collection, ownership records, and contract repositories.
- • Criticality assessment and risk tiering criteria.
- • Concentration risk and fourth-party (subcontractor) exposure.
- • Data access and privacy classification.
- • Inherent risk scoring models and tier thresholds.
- • Workshop: tiering a sample third-party portfolio.
Due Diligence and Assessment
- • Designing due diligence proportionate to risk tier.
- • Questionnaires, certifications, and evidence collection.
- • Financial, operational, and cyber due diligence.
- • Site visits, references, and capability reviews.
- • ISO 31000 risk assessment applied to third parties.
- • Documenting assessment results and risk decisions.
- • Workshop: completing a due diligence assessment file.
Contracting, Controls, and Monitoring
- • Contract clauses: SLAs, data protection, audit rights, and termination.
- • Mapping controls to NIST SP 800-161 supply chain practices.
- • COSO internal control design for third-party processes.
- • Key risk indicators (KRIs) and continuous monitoring tools.
- • Performance scorecards and service review meetings.
- • Issue management, escalation, and remediation tracking.
- • Workshop: building a third-party monitoring dashboard.
Reporting, Exit, and Programme Maturity
- • Board and executive reporting on third-party risk.
- • Risk dashboards, heat maps, and concentration summaries.
- • Exit planning, transition, and data return or destruction.
- • Business continuity and third-party disruption scenarios.
- • TPRM maturity models and continuous improvement.
- • Embedding TPRM into procurement and onboarding workflows.
- • Course review, assessment, and action planning.
Conclusion
By successfully completing Third-Party Risk Management (TPRM), participants will gain a complete understanding of how to identify, assess, contract, monitor, and exit third-party relationships with confidence. They will also acquire practical skills in risk tiering, due diligence, control design, and performance monitoring. In addition, the course prepares them to report third-party risk clearly to leadership and boards. Gentex Training Center delivers this programme with a strong focus on applied practice and measurable risk reduction.
FAQs for Third-Party Risk Management (TPRM) course
— What is the "Third-Party Risk Management (TPRM)" course about?
It is a five-day programme covering the full lifecycle of third-party risk. It explains how organisations identify vendors and partners, assess their risk, set proportionate controls, monitor performance, and manage exits, so external relationships stay aligned with business and regulatory needs.
— What are the key benefits of the "Third-Party Risk Management (TPRM)" course?
Participants gain a structured way to manage outsourced and supplier risk instead of reacting to incidents. The course reduces data, operational, and compliance exposure, improves contract quality, strengthens regulatory readiness, and delivers clearer reporting so leadership can act on third-party risk with confidence.
— What skills will I gain from the "Third-Party Risk Management (TPRM)" course?
Participants gain third-party identification and risk tiering, due diligence and risk assessment, TPRM contract and control design, and third-party monitoring, reporting, and exit planning. These four skills cover the complete third-party risk lifecycle.
— What tools, methods, or standards are covered in the "Third-Party Risk Management (TPRM)" course?
The course covers the ISO 31000 framework, the COSO internal control framework, NIST SP 800-161 supply chain risk practices, third-party inventories, criticality and tiering models, due diligence questionnaires, SLA and audit-right clauses, KRIs, risk registers, performance scorecards, monitoring dashboards, heat maps, and TPRM maturity models.
— How is the "Third-Party Risk Management (TPRM)" course applied in real-world practice?
Participants apply the methods in their own organisations. They build or clean up third-party inventories, tier suppliers by risk, run due diligence, redraft contract clauses, set monitoring indicators, and prepare exit plans. Many leave with a TPRM improvement roadmap ready to implement.
Contact our team and let us help you find the right option.
Introduction
The Third-Party Risk Management (TPRM) Training Course builds the skills needed to manage the risks that vendors, suppliers, contractors, and partners bring into an organisation. Outsourcing, cloud services, and complex supply chains expand reach, yet they also transfer risk beyond direct control. This course explains how to identify third parties, assess their risk, and set proportionate controls across the full relationship lifecycle. Furthermore, it covers regulatory expectations, due diligence, contract clauses, monitoring, and exit planning. As a result, participants learn to protect operations, data, and reputation while keeping the business benefits of external partnerships intact.
Third-Party Risk Management (TPRM) Course Objectives
- Explain the core concepts and business case for third-party risk management.
- Identify and inventory third parties across all business functions.
- Classify third parties by criticality, data access, and regulatory exposure.
- Apply risk assessment methods using likelihood, impact, and inherent versus residual risk.
- Design due diligence and onboarding processes proportionate to risk tier.
- Align TPRM practice with ISO 31000 and the COSO internal control framework.
- Map TPRM controls to NIST SP 800-161 supply chain risk practices.
- Build contract clauses covering data protection, SLAs, audit rights, and termination.
- Monitor third-party performance using KPIs, KRIs, and continuous monitoring tools.
- Prepare exit strategies, concentration risk reviews, and board-level TPRM reporting.
Course Methodology
- Interactive lectures with cross-industry third-party risk case studies.
- Workshop exercises on tiering, questionnaires, and due diligence files.
- Simulated vendor reviews and risk committee decisions.
- Templates for risk registers, scorecards, and monitoring dashboards.
- Structured peer discussion with facilitator feedback on live TPRM challenges.
Who Should Take This Course
- Risk managers and enterprise risk officers.
- Procurement and supplier management professionals.
- Compliance, legal, and contract specialists.
- Information security and data privacy officers.
- Internal auditors reviewing third-party controls.
- Operations and vendor relationship managers.
Third-Party Risk Management (TPRM) Course Outlines
Foundations of Third-Party Risk Management
- • Core TPRM concepts, terminology, and business drivers.
- • Third-party categories: vendors, suppliers, contractors, and partners.
- • The TPRM lifecycle: identify, assess, contract, monitor, and exit.
- • The three lines model applied to third-party risk.
- • Regulatory expectations and outsourcing rules.
- • Governance roles, policies, and TPRM frameworks.
- • Case study: a third-party failure and its organisational impact.
Identification, Inventory, and Risk Tiering
- • Building and maintaining a third-party inventory.
- • Data collection, ownership records, and contract repositories.
- • Criticality assessment and risk tiering criteria.
- • Concentration risk and fourth-party (subcontractor) exposure.
- • Data access and privacy classification.
- • Inherent risk scoring models and tier thresholds.
- • Workshop: tiering a sample third-party portfolio.
Due Diligence and Assessment
- • Designing due diligence proportionate to risk tier.
- • Questionnaires, certifications, and evidence collection.
- • Financial, operational, and cyber due diligence.
- • Site visits, references, and capability reviews.
- • ISO 31000 risk assessment applied to third parties.
- • Documenting assessment results and risk decisions.
- • Workshop: completing a due diligence assessment file.
Contracting, Controls, and Monitoring
- • Contract clauses: SLAs, data protection, audit rights, and termination.
- • Mapping controls to NIST SP 800-161 supply chain practices.
- • COSO internal control design for third-party processes.
- • Key risk indicators (KRIs) and continuous monitoring tools.
- • Performance scorecards and service review meetings.
- • Issue management, escalation, and remediation tracking.
- • Workshop: building a third-party monitoring dashboard.
Reporting, Exit, and Programme Maturity
- • Board and executive reporting on third-party risk.
- • Risk dashboards, heat maps, and concentration summaries.
- • Exit planning, transition, and data return or destruction.
- • Business continuity and third-party disruption scenarios.
- • TPRM maturity models and continuous improvement.
- • Embedding TPRM into procurement and onboarding workflows.
- • Course review, assessment, and action planning.
Conclusion
By successfully completing Third-Party Risk Management (TPRM), participants will gain a complete understanding of how to identify, assess, contract, monitor, and exit third-party relationships with confidence. They will also acquire practical skills in risk tiering, due diligence, control design, and performance monitoring. In addition, the course prepares them to report third-party risk clearly to leadership and boards. Gentex Training Center delivers this programme with a strong focus on applied practice and measurable risk reduction.
FAQs for Third-Party Risk Management (TPRM) course
— What is the "Third-Party Risk Management (TPRM)" course about?
It is a five-day programme covering the full lifecycle of third-party risk. It explains how organisations identify vendors and partners, assess their risk, set proportionate controls, monitor performance, and manage exits, so external relationships stay aligned with business and regulatory needs.
— What are the key benefits of the "Third-Party Risk Management (TPRM)" course?
Participants gain a structured way to manage outsourced and supplier risk instead of reacting to incidents. The course reduces data, operational, and compliance exposure, improves contract quality, strengthens regulatory readiness, and delivers clearer reporting so leadership can act on third-party risk with confidence.
— What skills will I gain from the "Third-Party Risk Management (TPRM)" course?
Participants gain third-party identification and risk tiering, due diligence and risk assessment, TPRM contract and control design, and third-party monitoring, reporting, and exit planning. These four skills cover the complete third-party risk lifecycle.
— What tools, methods, or standards are covered in the "Third-Party Risk Management (TPRM)" course?
The course covers the ISO 31000 framework, the COSO internal control framework, NIST SP 800-161 supply chain risk practices, third-party inventories, criticality and tiering models, due diligence questionnaires, SLA and audit-right clauses, KRIs, risk registers, performance scorecards, monitoring dashboards, heat maps, and TPRM maturity models.
— How is the "Third-Party Risk Management (TPRM)" course applied in real-world practice?
Participants apply the methods in their own organisations. They build or clean up third-party inventories, tier suppliers by risk, run due diligence, redraft contract clauses, set monitoring indicators, and prepare exit plans. Many leave with a TPRM improvement roadmap ready to implement.
Partners in Learning
Our Partners in Learning include leading companies and organizations that trust Gentex Training Center for high-quality training courses and professional development programs. Together, we deliver impactful training programs that support skills growth, leadership development, and organizational excellence.
.png)
