THIRD-PARTY RISK MANAGEMENT: Assess the risks behind your supplier relationships.
Third-party risk management assesses the security exposure created by suppliers' access, data handling and role in important services. Subdux helps establish proportionate due diligence, evaluate supporting evidence and follow concerns through onboarding, renewal and changes, so decisions reflect the dependency rather than a questionnaire score alone.
- Discipline
- Managed Security & Advisory
- Engagement type
- Managed
Start with what the supplier can affect.
Treating every supplier alike creates a large review queue and little assurance about the relationships that matter most. We organise scrutiny around the data involved, system access, service dependency and consequences of disruption. The result is a proportionate way to decide which suppliers need deeper examination and which can follow a lighter process.
Buying situations
New suppliers are being approved without a consistent security review.
Existing questionnaires and certificates are collected but rarely challenged or followed up.
Renewals, subcontractors and changes to supplier access have become difficult to track.
Assess the relationship across its lifecycle.
Inventory and tiering
Establish the suppliers in scope, business contacts, services provided and a practical basis for prioritisation.
Due diligence
Select relevant questions and examine available reports, policies, security information and material exceptions in the context of your use of the service.
Further investigation
Clarify important gaps with the supplier. A critical dependency may justify a deeper review than standard questionnaire responses provide.
Conditions and follow-up
Record corrective actions, restrictions or unresolved concerns, with a route for the business to approve or reconsider the relationship.
Change, renewal and exit
Revisit material changes, supplier incidents and renewal decisions; address access removal and information return or deletion when the service ends.
Keep the review connected to the purchasing decision.
We can assess selected suppliers or establish and operate a wider review programme. Procurement, technology, legal and business teams contribute different parts of the picture. Security findings need to reach the people making the purchasing or renewal decision while there is still an opportunity to act on them.
What you receive
A tiered supplier register; completed reviews with supporting information and unresolved questions; a tracked set of supplier actions and exceptions; review criteria and workflow; and a summary of material dependencies for leadership. Contract-related security requirements can be prepared for review with your legal advisers.
Does a supplier's ISO certificate or SOC 2 report complete the review?
It can be useful supporting information. We examine whether its scope, period, exceptions and stated responsibilities cover the service you will use. A document about one part of a supplier's business may say little about your particular relationship.
Can you assess a supplier that will not share much information?
We can evaluate what is available, request clarification and explain where uncertainty remains. Restricted information may affect the conditions under which you are comfortable using the supplier; it cannot simply be treated as confirmation that controls are in place.
Is this a one-off project or ongoing service?
Either. A review of a major supplier can stand alone. Ongoing support is useful when onboarding volumes, renewals or critical dependencies require a maintained process.
Begin with the relationships you rely on most.
Tell us which services suppliers provide, what access they hold and where your current review process loses momentum.
Related services: Virtual CISO and SEBI / RBI / IRDAI Audit Readiness.