Every TPRM guide online was written for a Fortune 500 compliance team. This one is for the operations manager at a 50-person fintech who just got asked by their enterprise customer: “Can you show us your TPRM programme?” You need a real answer. Here it is.
TPRM (Third Party Risk Management) is how your business identifies, assesses, and monitors the risks that come from everyone outside your payroll — suppliers, contractors, SaaS tools, cloud providers, and professional services firms. When an enterprise customer asks for your “TPRM programme,” they want documented proof: you know which third parties could hurt your business, you checked them, and you keep checking.
Why TPRM matters right now, not in theory:
Every other TPRM guide assumes you have a 10-person GRC team and a £100k software budget. This page is for the ops manager who needs a working TPRM answer this week — not a six-month implementation project. For the full discipline beyond the acronym, see our third party risk management guide.
TPRM is not a new activity. You already ask suppliers for insurance certificates. You already worry about a key vendor going bust. TPRM is the documented, repeatable version of what you do informally — with evidence you can export when a customer or regulator asks.
A TPRM framework is the structure behind your vendor risk programme. Enterprise frameworks (NIST, ISO 27036, DORA) describe the same five components — scaled for organisations with dedicated compliance teams. Your small business TPRM framework needs all five; none require a GRC specialist to run.
List every supplier, SaaS tool, contractor, and service provider you pay. Then tier each one: Critical (handles sensitive data, single-source dependency, or >10% of spend), High, Medium, or Low. Critical and High vendors get full TPRM scrutiny; Low vendors get light documentation. The average SMB uses 27–50 SaaS tools. Most have no inventory of what data each one can access. Without a tiered inventory, your TPRM programme has no foundation.
Apply consistent questions to every vendor in the same tier. Inherent risk is what risk the vendor category carries before your controls — a payroll processor handling employee bank details carries higher inherent risk than a stationery supplier. Residual risk is what remains after you collect evidence: valid SOC2, signed DPA, current insurance, clean questionnaire responses. Your TPRM framework needs a scoring method (Green/Amber/Red works fine) that is the same for every vendor and defensible when an auditor asks how you arrived at it.
Before onboarding a new vendor, run a pre-contract check: Companies House registration, news search, website review, financial stability signals. Collect evidence: SOC2 Type II, ISO27001 certificate, GDPR Data Processing Agreement, cyber liability insurance, breach notification process. Send a vendor security questionnaire scaled to tier — 15 questions for a SaaS tool, not 800. Full pre-onboarding steps are in our vendor due diligence checklist.
TPRM risk is not static. Insurance certificates expire. Vendors get breached. Key people leave. Policies change. For a small business TPRM programme, monitoring means: quarterly reviews for Critical and High vendors, annual reviews for Low, automated alerts 90 days before any certificate lapses, and immediate reassessment when a vendor reports a breach or acquisition. This is where spreadsheet-based TPRM programmes fail — accurate on day one, wrong six months later.
The TPRM step everyone forgets. When you stop using a vendor: revoke system access, send a GDPR Article 17 data deletion request, confirm deletion in writing, terminate the contract formally, and update your risk register. A vendor you offboarded two years ago who still has API access to your CRM is an active TPRM liability. Document the offboarding checklist once; run it every time.
The TPRM process turns your framework into a repeatable workflow. Seven steps, start to finish. Steps 3–7 are where TPRM software saves the most time for a team without dedicated compliance staff.
Export from Xero or QuickBooks. Add SaaS subscriptions your team signed up for without IT approval. Include contractors, agencies, and one-off professional services. One afternoon gets you a complete list. This is step one of every TPRM process — you cannot assess vendors you have not listed.
Assign Critical, High, Medium, or Low based on: data access (does this vendor touch customer PII or financial data?), spend concentration, single-source dependency, and regulatory exposure. A 50-person fintech might have 8 Critical vendors, 15 High, and 30 Low. Your TPRM process applies proportionate effort to each tier.
Before the contract is signed: verify the company exists, check Companies House filings, search for adverse news, review their security page, note financial stability signals. Document what you found. This is the TPRM due diligence stage that prevents onboarding a vendor who cannot answer basic questions six months later. See our vendor due diligence guide for the full checklist.
Request SOC2 Type II or ISO27001, signed GDPR DPA, cyber liability insurance certificate, and breach notification timeline. Send a structured security questionnaire via link — track who has not responded. Store every document against the vendor record with extracted expiry dates.
Calculate a risk score from document completeness, certificate validity, and questionnaire flags. High-risk vendors: quarterly review. Medium: semi-annual. Low: annual. Your TPRM process should recalculate scores automatically when evidence changes — not require a manual spreadsheet update every quarter.
Insurance expiry alerts at 90, 60, 30, and 7 days. Breach watchlist monitoring. Policy change detection. Risk score updates when a certificate lapses or a vendor reports an incident. Continuous monitoring is what separates a real TPRM programme from a one-time audit snapshot.
Access revocation checklist. GDPR Article 17 data deletion request with confirmation tracking. Contract termination documented. Risk register updated to show vendor as inactive. Your TPRM process is only complete when offboarding is as documented as onboarding.
Enterprise TPRM software was built for organisations with 500+ vendors and dedicated compliance teams. Here is what it costs — and what small businesses actually need from TPRM software instead.
£100,000+
Enterprise
£50,000+
Enterprise
£21,000+
Mid-market
£30,000+
Enterprise
From $49/month
Small Businesses
Enterprise TPRM tools require an implementation consultant, a 6-month rollout, and a dedicated team to operate them. Most small businesses do not have any of those. What small business TPRM software actually needs to deliver:
No six-month implementation project. Import your vendor list, upload existing documents, send your first questionnaire before lunch. TPRM software should reduce your workload, not create a new one.
SOC2, ISO27001, GDPR, and DORA-aligned templates ready to send. Not a blank form you build from scratch over three weeks.
Automatic alerts at 90, 60, 30, and 7 days before any certificate lapses. The most common TPRM failure mode is an expired insurance cert nobody noticed.
Green/Amber/Red scores calculated from evidence completeness. No risk matrix workshop required.
One-click export of your vendor risk register, assessment history, and questionnaire responses. The document your enterprise customer actually wants when they ask about your TPRM programme.
Two EU regulations changed what TPRM means for small businesses selling into regulated industries. Here is what each requires — and who it affects at your company size.
Scope: financial entities and ICT service providers in the EU. Article 28 TPRM requirements:
Fines: up to 2% of global annual turnover or €10 million.
Scope: wider than original NIS — more sectors and company sizes included. Article 21 supply chain security:
Fines: up to €10 million or 2% of global turnover.
Who this affects at SMB level: fintech companies providing services to EU banks; SaaS companies with financial institution customers; companies in the NIS2 “important entities” category; and any SMB whose enterprise customers are themselves DORA-regulated. If your enterprise customer is in financial services, they need you to have a TPRM programme — because DORA holds them responsible for their suppliers’ risk management. Your TPRM evidence pack becomes part of their regulatory submission.
You do not need a 200-item TPRM checklist. You need the minimum that satisfies an enterprise customer questionnaire or a regulator request. Seven items. If you can tick all seven, you have a defensible TPRM programme for your small business.
Every supplier, SaaS tool, and contractor listed with contact details, contract dates, and internal owner assigned.
Critical / High / Medium / Low assigned based on data access, spend concentration, and business criticality. Tiering documented and reviewable.
SOC2/ISO27001 evidence requested. Responses stored against vendor record with completion date.
Expiry dates tracked. 90-day advance alerts configured. No certificate allowed to lapse without a documented decision.
Reviewed quarterly for High-risk, annually for Low. Score methodology documented and consistent across the portfolio.
Vendor register, assessment history, and questionnaire responses exportable in one report. Ready to send within 24 hours of a customer request.
Access revocation and GDPR data deletion confirmed on every vendor exit. Risk register updated within 48 hours of termination.
Ten questions ops managers ask when building their first TPRM programme. Answers match our structured data for search accuracy.
No compliance team. No implementation consultant. Running in under an hour.
Free forever on 3 vendors · No credit card · TPRM evidence export included