🤝 Third-party risk management (TPRM)

"Your vendors. Their risk. One platform."
Screen a supplier, send only the questionnaires that matter, review the answers, and close an evaluation you can explain later.

Third-party risk management (supplier management) brings vendors into the same Brainframe workspace where you already govern risks, controls, and documents. Assessments no longer live in spreadsheets and mailboxes. Each supplier has a record, each evaluation has a clear cycle, and every reply keeps a history of who said what.

1️⃣ Why this exists

Most organisations already run risks, controls, and frameworks inside a GRC platform. Suppliers are often the part that still sits outside it.

Typical gaps:

• Questionnaires in circulation — Excel files sent by email, returned in different versions, with no reliable scoring.
• Evidence in mailboxes — certificates, reports, and contracts stored where they are easy to lose and hard to challenge.
• Reviews without proof — no clear record of who reviewed an answer, what they questioned, or which risk decision was approved.
• Registers rebuilt by hand — the supplier list assembled again each cycle from sources that do not agree.

Brainframe closes that gap inside the platform you already use. The same login, the same permissions, and the same risk and control model. Supplier management is an extension of your GRC work, not a second tool to reconcile.

A supplier record can carry the assessments, the risks and controls you accept, the evidence, and the decision to review again later. You do not retype the outcome into another register.

2️⃣ One evaluation, from first look to signed-off result

A supplier assessment is a repeatable cycle. You do not send every form to every supplier, and you do not lose last year’s answers when you start again.

📌 Closing an evaluation freezes that version. A later reassessment is a new evaluation. It does not overwrite the past.

3️⃣ Forms: design the template once

A form template is the blueprint. You design it once. You do not rebuild the questions for every supplier.

The template defines:

• Categories and questions — so people fill the form in a clear order.
• Reply types — free text, choices, uploads, and the other answer formats you need.
• Scores — a value on an answer when you want the reply to count toward maturity.
• Follow-up questionnaires — an answer can unlock a deeper form, such as extra due diligence.
• What happens next — for example filling fields on a document, adding work to a board, reading an answer as a risk signal, or notifying the people who must review it.

Two ways to use the same kind of form

💡 A request form is for collecting information again and again. A supplier questionnaire is for assessing, reviewing, locking, and keeping the story of that supplier.

4️⃣ How forms are set up for suppliers

Supplier questionnaires use that same template family, with a role in the assessment.

In vendor settings, each supplier type points at the forms that type should use:

• Pre-assessment — the opening questionnaire. Every evaluation starts here.
• Due diligence — the deeper questionnaires that may apply after the pre-assessment.

You choose which published form templates play those roles. A logistics supplier and an ICT supplier do not have to share the same questions.

On the template itself you decide how strict the form is: which answers are scored, which answer opens a follow-up, who is told when the questionnaire is ready for review, and which replies should be treated as risk signals before a person looks at them.

5️⃣ Why you start with a pre-assessment

The pre-assessment is a screen, not the full audit.

It is often completed internally, by the person who knows the engagement: what the supplier will do, which data they will see, and how critical the service is. You can also send it out when the supplier should answer the first questions themselves.

The answers decide the depth of the rest of the evaluation. A low-risk engagement may stop after the pre-assessment. A supplier that processes sensitive data, runs critical ICT, or sits in a regulated chain should continue into due diligence.

That is the point of the first form:

• You learn enough to judge whether more questions are justified.
• You avoid sending a long security pack to a supplier who does not need it.
• You keep a record of why the later questionnaires were, or were not, used.

6️⃣ Follow-up questionnaires go only as deep as the answers require

Due diligence forms are optional, and they are more specific. Security, privacy, resilience, or another topic you have designed — each one is a separate questionnaire.

A follow-up becomes relevant in two ways:

• The supplier type already lists it as a due diligence form for that kind of supplier.
• An earlier answer unlocks it. A “yes” on a pre-assessment question can be the reason a deeper form is in scope. (marked in yellow)

You then send each questionnaire to the person who can actually answer it. Legal, security, and the supplier’s main contact do not have to share one inbox. If an answer is weak, you can ask for an update and send that questionnaire again.

📌 You do not send every form to every supplier. You send what the pre-assessment, and the supplier type, justify.

7️⃣ Supplier types keep the right forms together

A supplier type is the profile for a kind of third party: ICT, a professional service, a processor, logistics, or any split that matches how you buy.

Each type can have:

• its own pre-assessment
• its own set of due diligence forms
• its own place in your supplier settings, so onboarding does not start from a blank list

When someone starts an evaluation and chooses the type, Brainframe preselects that pre-assessment and the due diligence questionnaires that can apply. The user still chooses what to send. The type simply stops them from assembling the pack by hand.

8️⃣ Prepare the risk type before you rely on AI

Supplier work should land on a document type and a risk type you have configured for third parties.

Set this in vendor settings:

• Supplier document type — where the supplier itself is stored.
• Default risk type — the risk method used when you evaluate that supplier.

The risk type is what makes the later steps consistent. Its methodology is how you score and read risk. Its treatment plan template is the structure of the plan you will write when the evaluation is closed.

When AI is enabled, those two settings do a large part of the repetitive work:

• Suggest findings and a maturity view while you review replies.
• Propose risks that fit this supplier and this risk type, instead of a generic list.
• Suggest controls that belong on those risks.
• Draft a treatment plan from the template, using the supplier, the risks, the controls, and the questions you marked.

AI prepares the work. Your reviewers still accept, change, or reject every suggestion before it counts. Accountability stays with the risk owner.

9️⃣ A typical journey

This is the path from the supplier module. The screens follow the cycle above.

Start the evaluation and choose the supplier type

Open the supplier and start onboarding, or start a new evaluation when it is time to reassess.
You select the supplier type. That choice preselects the pre-assessment and the due diligence questionnaires that may apply. You can see the pack before anything is sent. Complete the pre-assessment internally when your own team already knows the answers.

Send the questionnaires

From the supplier, send each questionnaire that should go out. Different forms can go to different people.
The supplier receives a secure link and answers in the portal. They do not need access to your internal workspace.

The supplier can invite colleagues

The person who receives the link can delegate the same questionnaire to colleagues who know a specific section. Several people can work on one form together.

Self-hosted: the portal can be in the cloud, the record stays with you

On a cloud Brainframe workspace, suppliers answer on the same platform.

On a self-hosted installation, you can keep the internal platform private and still let suppliers answer on a public portal in the cloud:

• You publish the questionnaire outward. The supplier never connects to your internal environment.
• You pull the replies back when you choose, including the evidence they uploaded.
• After that pull, the answers live in your own Brainframe. That copy on the portal is cleared.
• Your risks, controls, documents, and workflows remain the system of record.

A problem on the public portal does not open your internal GRC data. The exchange is started from your side.

Review a completed questionnaire

When a questionnaire is submitted, the reviewers configured on the form are notified.

Open the review and go through the replies. For each answer you can:

• record a finding
• set the maturity of the reply
• mark it Accepted when it is good enough
• mark it Mark as risks when it must feed the supplier risk evaluation
• mark it Requires update when the supplier must answer again, then resend

AI can pre-analyse the questionnaire: suggested findings, a maturity reading, and the replies that look incomplete or weak. You confirm or correct those suggestions. Nothing is committed because the model proposed it.

Bring every “mark as risks” reply into one risk evaluation

You do not treat each questionnaire as a separate risk exercise. When the questionnaires you need have been reviewed, open Review risks.

Every reply you marked Mark as risks, across every questionnaire in the evaluation, is in scope together. From there you build the risk picture for this supplier:

• Link a risk that already exists on the supplier or in your register.
• Add a risk from the risks you have already defined for this risk type.
• Let AI propose new risks in the context of this supplier, these answers, and your methodology.

You then link the controls that apply. AI can suggest those as well. You set how far each control is implemented, and you remove anything that does not belong.

Close the evaluation and plan the next review

When the risk review is complete, lock the evaluation.

Locking does three things:

• It writes the signed-off risks and controls onto the supplier.
• It freezes this evaluation. Questions, replies, findings, and the risk decisions stay as they were, even if you later edit the form template.
• It lets you plan the next review, so the reassessment has an owner and a date.

After it is closed, write the treatment plan

A locked evaluation can produce a treatment plan for that supplier and that evaluation.

Generate it with AI, or write it yourself. The AI draft uses the treatment plan template of the supplier risk type, together with the supplier context, the risks and controls you linked, how far those controls are implemented, and the questionnaire replies you marked as risks. The result is a document on the evaluation, linked to the supplier, that you can open and edit like any other document.

The plan is the narrative of what you will do. The locked evaluation remains the evidence of what you decided.

🔟 What you can still see later

The audit log keeps the full story: replies, review actions, and the risks you selected.

For a question, you can open the history rather than only the latest answer. If an auditor asks what this supplier said two years ago, the evaluation from that cycle is still there.

When you start the next evaluation:

• It uses the latest form templates.
• Previous answers are carried onto questions that still exist, so nobody starts from an empty page.
• The work is still marked to be done again. Carried-forward answers are a head start, not a sign-off.
• Uploaded evidence is cleared and must be provided again.

📌 Lock means this evaluation is closed. A new evaluation is a new version. History means you can explain why.

✅ A practical checklist

• Supplier types exist, each with a pre-assessment and the due diligence forms that type may need.
• The supplier document type and the default risk type are set, including the treatment plan template if you will use AI.
• A new supplier starts from onboarding, with the type chosen before questionnaires are sent.
• The pre-assessment is completed before deeper forms go out.
• Each sent questionnaire has a real recipient, who can invite colleagues.
• Reviewers use Accepted, Mark as risks, or Requires update, and they write a finding where it matters.
• Review risks covers every marked reply, with risks and controls confirmed by a person.
• The evaluation is locked, the next review is planned, and the treatment plan is stored on that evaluation.

Updated on: 30/09/2026