Third-party risk management programmes often report how many questionnaires went out, which says little about whether the organisation knows its suppliers, assesses the right ones on time and closes what it finds. This health check is a recurring programme review built on nine KPIs: vendor inventory completeness, tiering coverage, overdue assessments, critical vendor reassessment, open finding age, contract security clause coverage, fourth-party visibility, offboarding completion and concentration risk. Each KPI has a formula, a data source type, thresholds, an owner and a cadence, with a findings log and a remediation map. It is run by the TPRM lead, checked by the second line, and signed off by the CISO or chief risk officer. The programme itself is described in the Third-Party Risk Management Guide; this page measures whether it is working.
What this health check covers
Scope is the TPRM programme across all suppliers, service providers and partners: how they are inventoried, tiered, assessed, contracted, monitored and exited. It measures programme outcomes and coverage. It does not audit the access suppliers hold in your systems (see the Third-Party Access Health Check) and it does not audit the TPRM tool as a platform (see the TPRM Platform Health Check). The three pages share no metrics.
Use the Third-Party Risk Management Maturity Model to set the target state; use this page each quarter to measure the current one. If you searched for TPRM KPIs, third party risk management metrics or a vendor risk program health check, this is the working run sheet for the review.
Key takeaways
- The inventory is the first KPI: suppliers found in accounts payable but missing from the TPRM register were never tiered, assessed or contracted, so every other KPI overstates coverage.
- Tiering decides where effort goes: measure critical vendors separately, because an overdue assessment on a payroll provider is not equal to one on a stationery supplier.
- Findings matter more than assessments: open finding age shows whether assessments change anything.
- The programme ends at exit: offboarding completion and concentration risk measure the two moments most programmes ignore, leaving and over-reliance.
- Thresholds are starting points: the bands are NHI Mgmt Group recommendations; tune them to your risk appetite and any regulatory obligations, and record why.
How to use this template
Copy the KPI table and the findings log into your own tracker. Fix the definitions of a critical vendor and of the assessment cycle for each tier before the first run, because KPIs TP-03 and TP-04 depend on them. Collect each figure from the data sources described, score it against the bands, and log every amber or red result as a finding with an owner and a due date. Report the results to the risk committee each quarter with the trend, not just the latest value.
Cadence and sign-off
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| Inventory reconciliation (TP-01, TP-02) | Quarterly | TPRM lead with procurement | Chief risk officer | Accounts payable extract, contract register, TPRM register, reconciliation sheet |
| Assessment and finding status (TP-03, TP-04, TP-05) | Monthly | TPRM analysts | TPRM lead | Assessment schedule, finding register export |
| Full KPI run (TP-01 to TP-09) | Quarterly | TPRM lead | CISO or chief risk officer | KPI workbook, findings log, risk committee paper, sign-off |
| Concentration and fourth-party review (TP-07, TP-09) | Yearly, and on any major supplier change | TPRM lead with business continuity | Risk committee | Dependency map, fourth-party register, concentration analysis |
| Independent re-performance | Yearly | Internal audit | Audit committee | Re-performed samples of ten suppliers across tiers, variance notes |
Metrics
The population is every supplier with an active contract or a payment in the last 12 months. NHI Mgmt Group recommended thresholds; adjust to your risk appetite.
| ID | KPI | Formula (numerator / denominator) | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| TP-01 | Vendor inventory completeness | Suppliers paid or under contract in the last 12 months that are in the TPRM register / suppliers paid or under contract in the last 12 months | Accounts payable and contract register joined to the TPRM register | ≥ 98% | 90% to below 98% | < 90% |
| TP-02 | Tiering coverage | Suppliers in the register with a current risk tier based on data access, system access and service criticality / suppliers in the register | TPRM register tier fields and inherent risk questionnaires | ≥ 98% | 90% to below 98% | < 90% |
| TP-03 | Assessment overdue rate | Suppliers whose due assessment for their tier is past its date / suppliers with an assessment due in the cycle | Assessment schedule and completion records | ≤ 5% | Above 5% to 15% | > 15% |
| TP-04 | Critical vendor reassessment rate | Critical-tier suppliers fully reassessed within the last 12 months, with evidence reviewed / critical-tier suppliers | Assessment records filtered to critical tier; evidence log | 100% | 90% to below 100% | < 90% |
| TP-05 | Open finding age | Open high-severity supplier findings older than the agreed remediation date / open high-severity supplier findings; report median age in days alongside | Supplier finding register | ≤ 10% | Above 10% to 25% | > 25% |
| TP-06 | Contract security clause coverage | Critical and high-tier contracts containing the standard security schedule (incident notification, audit rights, data handling, subcontractor approval, exit) / critical and high-tier contracts in force | Contract management system clause metadata; legal review sample | ≥ 95% | 80% to below 95% | < 80% |
| TP-07 | Fourth-party visibility | Critical-tier suppliers whose material subcontractors are recorded in the fourth-party register / critical-tier suppliers | Fourth-party register; supplier subcontractor disclosures | ≥ 90% | 60% to below 90% | < 60% |
| TP-08 | Offboarding completion | Suppliers exited in the period with a completed exit checklist (data return or destruction confirmed, access removal ticket raised with IAM, register closed; account disable timing is measured in the Third-Party Access Health Check) / suppliers exited in the period | Exit checklists; contract terminations; IAM confirmation records | ≥ 95% | 80% to below 95% | < 80% |
| TP-09 | Concentration risk count | Count of critical business services that depend on a single supplier, or on several suppliers sharing one fourth party, with no tested exit or substitution plan | Business service dependency map; fourth-party register; exit plan test records | 0 | 1 to 2, each accepted by the risk committee | ≥ 3, or any not accepted |
Notes on the formulas
- TP-01 uses money as the truth: the accounts payable ledger finds suppliers that bypassed procurement, such as card-paid SaaS. Exclude utilities and one-off purchases with no data or system access, and document the exclusion rule.
- TP-02 counts current tiers: a tier set three years ago before the supplier gained system access is stale. Re-tier on contract renewal and on any change of service.
- TP-04 means evidence reviewed: a returned questionnaire without reviewed evidence, such as an assurance report or test results, does not count. The Third-Party Attestation Comparison Map explains which reports cover what.
- TP-06 is sampled: clause metadata in the contract system is often incomplete, so check ten contracts by hand each quarter and record the variance. The Third-Party Security Contract Clauses Template gives a baseline schedule.
- TP-08 relies on IAM, not on the supplier: access removal is confirmed by your IAM team against your systems. The detailed access metrics live in the Third-Party Access Health Check.
- TP-09 links to resilience: the Third-Party Concentration Risk Guide covers how to map shared dependencies.
How to collect the data
- Reconcile the supplier universe: export 12 months of supplier payments from accounts payable and active contracts from the contract register, deduplicate by legal entity, and match to the TPRM register (TP-01).
- Export the TPRM register: tier, tier date, inherent risk inputs, assessment due and completion dates, and evidence status for each supplier (TP-02, TP-03, TP-04).
- Export the finding register: every open supplier finding with severity, opened date, agreed remediation date and status (TP-05).
- Pull contract metadata: clause flags for critical and high-tier contracts, then sample by hand (TP-06).
- Pull dependency data: the fourth-party register and subcontractor disclosures for critical suppliers, and the business service dependency map from business continuity (TP-07, TP-09).
- Collect exit evidence: contracts terminated in the period with their exit checklists and IAM confirmation records (TP-08).
- Sample: trace ten suppliers across tiers from payment record to tier, assessment, findings and contract clauses, and record any variance.
Red flags that need action now
- A supplier with access to sensitive data or production systems that is not in the TPRM register at all (TP-01).
- A critical-tier supplier with no reassessment in over 12 months (TP-04).
- High-severity findings at a critical supplier past their remediation date with no escalation (TP-05).
- A critical contract with no incident notification clause (TP-06). See the Third-Party Incident Notification Clauses Guide.
- No knowledge of where a critical supplier hosts your data or which subcontractors process it (TP-07).
- An exited supplier with no confirmation that your data was returned or destroyed (TP-08).
- Several critical services relying on one fourth party with no exit plan (TP-09).
- Assessments repeatedly closed as complete with no findings raised for any supplier, which usually means the questions are too easy.
Findings log
| Finding ID | Finding | KPI | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-TPRM-01 | [Number] paid suppliers missing from the TPRM register | TP-01 | [High / Medium / Low] | [Role] | [Date] | [Open / In progress / Closed / Risk accepted] |
| HC-TPRM-02 | [Number] critical suppliers overdue for reassessment | TP-04 | [Severity] | [Role] | [Date] | [Status] |
| HC-TPRM-03 | [Number] critical contracts without the security schedule | TP-06 | [Severity] | [Role] | [Date] | [Status] |
| HC-TPRM-04 | [Service] depends on a single supplier with no tested exit plan | TP-09 | [Severity] | [Role] | [Date] | [Status] |
| HC-TPRM-05 | [Finding] | [KPI] | [Severity] | [Role] | [Date] | [Status] |
Programme findings are owned by the TPRM lead or a business relationship owner, not by the supplier. Supplier findings stay in the supplier finding register; this log tracks weaknesses in the programme.
Remediation map
| Finding type | KPIs | Where the fix is explained |
|---|---|---|
| Incomplete inventory and tiering | TP-01, TP-02 | Third-Party Risk Management Guide |
| Overdue or shallow assessments | TP-03, TP-04 | Security Questionnaires Guide; Third-Party Attestation Comparison Map |
| Ageing supplier findings | TP-05 | Security Exceptions and Risk Acceptance Guide |
| Weak contracts | TP-06 | Third-Party Security Contract Clauses Template |
| Fourth-party blind spots | TP-07 | Fourth-Party and Nth-Party Risk Guide; Fourth-Party Register Template |
| Incomplete exits | TP-08 | Third-Party Access Guide |
| Concentration | TP-09 | Third-Party Concentration Risk Guide |
Related guides
- Third-Party Risk Management Guide: the programme this health check reviews.
- Third-Party Risk Management Maturity Model: map the KPI results to a maturity level.
- Third-Party Incident Response Playbook: when a supplier incident lands.
- Third-Party Access Health Check: access outcomes for vendor and contractor identities.
- Third-Party and Supply Chain Risk Executive Briefing: how to report the results to the board.
References
Framework anchors for the KPIs: NIST CSF 2.0 GV.SC-04 (suppliers known and prioritised by criticality), GV.SC-05 (requirements in contracts), GV.SC-06 (due diligence), GV.SC-07 (supplier risks assessed and monitored), GV.SC-09 (performance monitored) and GV.SC-10 (activities after the relationship ends); NIST SP 800-53 Rev. 5 SR-3, SR-5, SR-6 (Supplier Assessments and Reviews), SR-8 (Notification Agreements) and SA-9 (External System Services); CIS Controls v8.1 Control 15 (Service Provider Management); ISO/IEC 27001:2022 Annex A 5.19 to 5.22 on supplier relationships.
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- NIST: SP 800-53 Rev. 5
- NCSC: Principles of Supply Chain Security
- CIS: Control 15 Service Provider Management
Related NHI Mgmt Group resources: Third-Party Risk Management Guide, Third-Party Risk Management Maturity Model, Fourth-Party and Nth-Party Risk Guide, Third-Party Concentration Risk Guide.