What It Is
The Third-Party & Vendor Oversight module is MPG's comprehensive third-party risk management solution. It covers the entire vendor lifecycle: identification, onboarding, classification, due diligence, risk assessment, ongoing monitoring, review cycles, and offboarding — all connected to contracts, controls, and evidence.
Unlike standalone vendor management tools, MPG connects third-party risk to your broader governance framework. Vendor risks feed into your risk register, vendor assessments use your questionnaire library, vendor performance is tracked through your KPI frameworks, and vendor obligations are managed through your contract module.
The module supports concentration risk analysis, fourth-party (subcontractor) visibility, and tiered oversight based on risk classification — so you can focus your due diligence and monitoring resources where they matter most.
Who It Is For
Problems It Solves
How MPG Solves Them
MPG provides a structured onboarding workflow that guides vendors through classification, due diligence, risk assessment, contract setup, and approval — with configurable stages, assigned owners, and escalation rules. Critical vendors receive enhanced due diligence while low-risk vendors follow a streamlined path.
Ongoing monitoring connects vendors to your risk register, KPI frameworks, and assessment cycles. Risk-based review schedules ensure critical vendors are assessed more frequently, while continuous monitoring through KPIs and signals catches deterioration between formal reviews.
Concentration risk analysis identifies over-reliance on single vendors or vendor categories. Fourth-party visibility maps subcontractor relationships, and structured offboarding plans ensure data return, access revocation, and contract termination are handled properly.
Key Features
Reporting Studio & Governance AI
Every record in this module can be reported on
The Reporting Studio turns what your workspace records into governed figures — compiled from your own records, approved before anything leaves the workspace, and answered with citations.
Governed measures
Each figure is compiled from the module's own records and carries the instant it was read at and what it leaves out.
Approval before release
A report pack leaves the workspace only once the approval chain its report type requires has decided on it.
Answers you can check
The assistant points to the records each answer rests on, and it never approves, publishes, releases or deletes anything.
Workflow
Identify vendor and initiate onboarding workflow
Classify vendor by criticality, data access, and service type
Conduct due diligence via questionnaires and risk assessment
Review findings, assign risk tier, and approve or reject
Set up contract with obligations, SLAs, and review schedule
Monitor through KPIs, assessments, and continuous monitoring signals
Conduct periodic risk-based reviews and reassessments
Manage findings, remediation, and escalations
Execute structured offboarding when the relationship ends
Use Cases
Related Governance Risks
Related MPG Modules
Frequently Asked Questions
How does MPG handle vendor risk classification?
MPG uses configurable classification rules based on data sensitivity, service criticality, spend levels, and other factors. Vendors are automatically tiered (e.g., critical, high, medium, low), and the tier determines the level of due diligence, monitoring frequency, and oversight required.
Can I see fourth-party (subcontractor) relationships?
Yes. MPG allows you to map subcontractor relationships for each vendor, providing visibility into fourth-party risk. You can track which subcontractors your vendors use and assess the risk they introduce.
How does continuous monitoring work between formal reviews?
MPG connects vendors to KPIs, risk signals, and assessment triggers. When a monitored metric breaches a threshold — such as a SLA failure or a financial distress signal — the system alerts the vendor manager and can trigger an ad-hoc risk assessment.
What happens during vendor offboarding?
MPG provides structured offboarding plans with checklists for data return or destruction, access revocation, contract termination, and final performance review. This ensures no loose ends when a vendor relationship ends.
Can I track concentration risk?
Yes. MPG provides concentration risk analysis that identifies over-reliance on single vendors, vendor categories, or geographic regions, with alerts when concentration exceeds configurable thresholds.
Related Guides
Ready to strengthen your governance with Third-Party & Vendor Oversight?
Join organizations using My Premium Governance to transform their governance, oversight, and compliance operations.