Know every vendor by what it does: TPRM beyond questionnaires
Third-party risk programmes run on questionnaires that vendors fill in once a year. The risk shows up somewhere else: in payments, bank changes, filings and the news. Here is how to watch it.
Most third-party risk management (TPRM) starts with a questionnaire. The vendor answers a hundred questions, someone scores the answers, and the file is closed until next year.
Questionnaires tell you what a vendor says about itself. They don't tell you what the vendor does. For that you need data.
What a questionnaire can't see
- A vendor whose bank account changed three times this quarter
- A supplier that shares an address or a phone number with an employee
- A company that stopped filing its statutory returns
- A sudden rise in invoices just under an approval limit
- Adverse news, sanctions listings or litigation that appeared after onboarding
Each of these shows up in data you either own already or can read from public sources.
Three layers of evidence
1. Your own transactions
Payments, purchase orders, invoices and vendor master changes. These show how you actually deal with the vendor: how much, how often and through whom.
2. Public records
Company registrations, director details, tax filings and court records. These show whether the vendor is what it claims to be, and whether that is changing.
3. Signals from outside
News, sanctions and watch lists, and regulatory actions. These show what the rest of the world is saying.
Score the vendor, not the form
| Signal | Why it matters |
|---|---|
| Bank detail changes | The most common route to payment fraud |
| Links to employees | Conflicts of interest |
| Concentration of spend | Dependence on a single supplier |
| Filing gaps | Financial distress or a shell company |
| Adverse news | Reputation and continuity risk |
A score built from these updates itself. A vendor that was low risk at onboarding can become high risk in a month, and you see it in the month, not at the annual review.
Keep the questionnaire, change its job
Questionnaires still matter for things only the vendor can tell you, such as certifications and policies. Use them for that, and let the data do the monitoring.
CompliBear TPRM watches every vendor this way, and our third-party risk team helps you decide what to do about what it finds.