Vendor Risk Management (VRM)

Vendor Risk Management keeps your third-party inventory, risk tiers, due-diligence documents and reviews in one place. It requests SOC reports, insurance certificates and questionnaires from vendors, tracks what expires and when, and records each review, finding and follow-up so management, the board and examiners can see how every relationship is overseen.

The problem it solves

Regulators expect banks and credit unions to manage the risk of every third party across its whole life: before the contract, while it runs and when it ends. In many institutions that evidence is spread across spreadsheets, shared drives and email, so it is hard to show an examiner what was reviewed, by whom and what happened next.

Who it’s for

• Third-party risk managers who run the oversight program
• Procurement and vendor managers who own each relationship day to day
• Information security, privacy and business continuity reviewers
• Compliance and internal audit teams
• Boards and risk committees that oversee third-party risk

1. Inventory and tieringEvery third party recorded once, with its owner, the services it provides and a risk tier from an inherent-risk questionnaire, so effort goes where risk is highest.
2. Due diligenceRequests for documents and questionnaires go to the vendor through a secure upload link. Responses are attached to the vendor's record as they arrive.
3. ReviewReviewers record the scope, period and exceptions of SOC reports and map complementary user-entity controls to the people at your institution who own them.
4. Monitor and reportExpiring certificates and reports, reassessments due by tier, and open issues are tracked, and summarized for management, the board and examiners.

Single vendor inventory

One record per third party, with services, owners, contracts, documents, reviews and issues together.

Risk tiering

Configurable inherent-risk questions decide each vendor's tier and how often it is reassessed.

Critical activity flags

Relationships that support critical activities are marked for heightened oversight and contingency planning.

Vendor document requests

Ask for SOC reports, certificates of insurance, financial statements, policies and questionnaires, and chase them automatically.

Questionnaire library

Security, privacy, continuity and financial questionnaires you can adapt, with answers kept against the vendor.

SOC report reviews

A structured review template covering scope, period, opinion, exceptions, subservice organizations and complementary user-entity controls.

Bridge letter tracking

Gaps between a SOC report's period and today are recorded, with bridge letters requested and stored.

Expiry tracking

Insurance certificates, reports and contracts tracked against their dates, with reminders to the relationship owner.

Issues and remediation

Findings from reviews become issues with owners and due dates, kept until closed with evidence.

Contract terms

Term, renewal-notice and termination dates, and key rights such as audit and data return, recorded against the vendor.

Exit planning

For critical relationships, the exit and contingency plan is recorded and reviewed with the vendor's other evidence.

Board and exam reporting

Inventory by tier, overdue reviews and open issues, ready for committee packs and examiner requests.

Third-party risk manager

Configures tiers and questionnaires, assigns reviews and runs program reporting

Relationship owner

Proposes vendors, answers inherent-risk questions and records the conclusion of each review

Specialist reviewer

Reviews security, privacy, continuity, legal or financial evidence and raises findings

Control owner

Acknowledges and operates the complementary user-entity controls assigned to them

Auditor or examiner (read-only)

Views inventories, reviews, issues and the audit trail without changing them

Vendor contact

Uploads requested documents and answers questionnaires through a secure link

Vendor master

Vendors imported from your accounts-payable or procurement system by scheduled file or API, so the inventory is complete.

Contract repository

Contract dates and key terms recorded against the vendor, with links back to the signed agreement where it is stored.

Email

Requests and reminders sent to vendors and owners by email, each with a link back to the task.

Single sign-on

Staff sign in through your identity provider using SAML or OpenID Connect. Vendors use a secure link and need no account.

GRC and risk tools

Issues and vendor risk ratings shared with your governance, risk and compliance platform through the Work API.

Rating services

Reports from security or financial rating services you subscribe to can be imported or attached to the vendor's record.

Reporting tools

Inventory, review and issue data available to your data warehouse and business intelligence tools.

Single sign-on

Staff authenticate through your identity provider, so your own access policies and multi-factor requirements apply.

Role-based access

What each person can see and change follows their role, and sensitive documents can be limited to named reviewers.

Vendor links

Upload links are specific to one request and one vendor, and give no access to other vendors or your records.

Encryption

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization, as described in our Trust Center.

Audit trail

Every change to a vendor, document, review or issue is recorded with who made it and when.

Company-wide assurance

The product runs under the same controls as the rest of Moraph, which are independently audited to SOC 2 Type II and ISO/IEC 27001.

Moraph cloud

Hosted by Moraph in the United States, United Kingdom or Australia region.

Dedicated environment

Single-tenant hosting where your policies require it, scoped in the proposal.

With a managed service

Optionally run alongside a Moraph managed service for platform administration and configuration changes.

Program design

We review your third-party risk policy with you and turn it into tiers, review requirements and approval steps.

Questionnaires

Inherent-risk and due-diligence questionnaires are configured from our library and your existing questions.

Inventory load

Vendors are imported from your vendor master and existing spreadsheets, de-duplicated and matched to owners.

Document migration

Current SOC reports, certificates and contracts are loaded against the right vendors, with their dates.

Integrations

Single sign-on, the vendor master feed and any reporting connections are set up and tested.

Training and handover

Risk managers, relationship owners and reviewers are trained on their part of the workflow, and your team takes over configuration.

• It organizes and evidences due diligence. The risk decisions are made by your reviewers.
• It does not continuously scan vendors' internet-facing systems or financial health. Reports from rating services you subscribe to can be attached to the vendor's record.
• Questionnaire content and tiering rules are set up with you during implementation and owned by your team afterwards.
• It does not read SOC reports for you. Reviewers record the scope, exceptions and controls using the review template.
• It is not a contract management system. It records key dates and terms and links to the agreement held elsewhere.
• It does not manage purchasing, invoices or payments to vendors.
• Vendors must respond to requests themselves. The product reminds and escalates but cannot obtain documents a vendor declines to provide.
• Fourth parties are recorded as listed by your vendors; the product does not discover them independently.

• Show how a new vendor is tiered and how the tier changes the due diligence requested.
• Walk through a SOC 2 review, including exceptions and complementary user-entity controls.
• Show what a vendor sees when they receive a request, and what happens when they do not respond.
• Show how an issue from a review is followed to closure with evidence.
• Produce the reports a board committee and an examiner would ask for.
• Explain how our current spreadsheets and documents would be migrated.