Appearance
Third-Party Risk
Third-party risk in OrviQ rests on one structural decision: the party answers who, the engagement answers what, and only the engagement carries risk.
Pages in this area
| Page | Route | What it does |
|---|---|---|
| Third Parties | /third-party-risk | Parties, engagements, assessments and decisions |
Documentation for this area
| Article | What it covers |
|---|---|
| TPRM overview | The party and engagement distinction |
| Third Parties | Entity facts, certifications and offboarding |
| Engagements | Contract dates and the read-time lifecycle |
| Assessments | Criticality, classification, due diligence, risk |
| TPRM Governance | The four decision outcomes and segregation |
A third party does not have a risk rating
One provider might host your core banking platform and also supply office stationery. Rating the party would force one answer, and it would be wrong for at least one of them.
Permissions and entitlement
Requires the Third-Party Risk Management entitlement. tprm.assess, tprm.classify and tprm.decide are never auto-granted, including to Tenant Administrators.