Scaling a third-party risk programme
You design a programme that manages hundreds of suppliers: risk-based tiering, an automated questionnaire flow, external security ratings, concentration analysis, exit plans and management reporting.
Level 401 · 13 lessons · 12 practice labs
Lessons
Programme design
- Operating model: roles, process, tools
- A risk-based tiering model
- Assessment frequency and depth
- Quick task: apply a tiering score model
Scaling
- Automating the questionnaire flow
- Shared assessments and assurance exchange
- External security ratings and their limits
- Concentration and fourth-party analysis
- Quick task: a supplier portfolio analysis
Governance
- Tracking supplier findings
- Exit plans and substitution
- Programme reporting
- Capstone: a programme for a three-hundred-supplier portfolio
Practice labs
- Match the programme roles: Match twelve tasks to the business owner, procurement, security, legal or supplier manager role.
- Apply a tiering score model: Score forty suppliers with a weighted model, assign tiers and review the borderline ones by hand.
- Design the tiering model: Write a model document with criteria, weights, thresholds and the assessment frequency and depth per tier.
- Calculate the assessment workload: From the tier spread and frequency rules of three hundred suppliers, calculate the yearly assessments and person-days needed.
- Automate the questionnaire flow: Write a workflow design that defines sending, reminder, scoring and escalation steps and their rules.
- Acceptance criteria for shared assessments: Write what may replace your own questionnaire, and under which conditions, for suppliers offering a shared assessment, certificate or report.
- Read an external security rating: Sort the findings in five suppliers' external rating reports into real risk, wrong attribution or trivial.
- A supplier portfolio analysis: From a three-hundred-row portfolio, derive the spread by tier, country, service type and overdue assessments and write three key findings.
- Concentration and fourth-party analysis: From critical suppliers' subcontractor data, find the shared dependency points and write a risk note for management.
- Track the supplier findings: In a sixty-finding log, mark the overdue items, the ownerless ones and accepted risks whose acceptance has expired.
- An exit and substitution plan: Write a plan for a critical payment provider with triggers, alternatives, transition time and data migration steps.
- Prepare the programme report: From Yakamoz Telekom's portfolio data, write a quarterly programme report with coverage, open findings, concentration and resource needs.
About this course
You design a programme that manages hundreds of suppliers: risk-based tiering, an automated questionnaire flow, external security ratings, concentration analysis, exit plans and management reporting.
What you will learn
- Programme design
- Scaling
- Governance
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.