Policy, Program, and Procedures

This message was posted by a user wishing to remain anonymous This is a fairly dated response but I thought of one thing to add. I agree with the approach Debbie stated, first of all. In a prior shop where I worked, we established criticality very ... More

Hannah, Thank you for the thoughtful response. Vendor attestations are not something I had considered before, so I really appreciate the recommendation. We can absolutely incorporate language into our onboarding platform, Zip, through the vendor ... More

This message was posted by a user wishing to remain anonymous Venminder has a policy template that details what vendors to be exempt from oversight. I believe you can find it on this site. More

Tiffany, What you're describing is one of the more challenging issues in TPRM right now, and I don't think training or annual check-ins will fix it on their own. Not because they aren't valuable, but because the bigger gap is timing. Vendors are ... More

Hi Tiffany, Great question! We recently updated our Risk Classification Questionnaire (RCQ), which by the way is a stand-alone Excel. We added 2 questions to address the issues you ask about. Whenever there is a new agreement for review, whether it ... More