Policy, Program and Procedures

I find Third Party Risk Association to be a great resource. A standard membership for Practitioners is free and I highly recommend it. 

I got my Certified Regulatory Vendor Program Manager certification through Compliance Education Institute. I believe this program is tailored to Financial Services industry. The CRVPM was a great way to get a deep understanding of TPRM from the regulatory compliance point of view. They also have other certification courses for more specific aspects of TPRM such as contract structuring. 

Shared Assessments offers a Certified Third Party Risk Professional certification as well as free webinars.  I believe the ABA also offers some certifications.  This community forum helpful too.

Throwing in a plug for the Ncontracts Nstitute Certified Vendor Management Professional (NCVMP) certification. It's built around the requirements of the Interagency Guidance on Third-Party Relationships: Risk Management. The course is comprehensive.

Both Venminder and Ncontracts also offer a lot of free webinars, including their TPRM Bootcamp in June. 

@Eddie - Great question.  While maintaining my PMP, at least one third of the credits covers risk management, and another third in cloud best practices ( security, AI, NHI, and trust) I utilized projectmanagement.com (part of pmi.org) for excellent 1 hour on-demand courses and you can find AI risk, third party risk, etc. Also, The Cloud Security Alliance has a number of Trust Summits (3 to 5 each year) which are dished out typically as 2 hours each day for two to three days.  Both of those have excellent sources for third party risk management, and provide PDUs/certificates.   For emerging threats, while I use CSA, I use CISA.gov Incident Response Training and Range training that cover many topics based on NIST Cybersecurity Framework and other NIST recommendations.  (cisa.dhs.gov). 

I am sure many will have specific Risk certificate recommendations so I won't repeat those. 

However, Venminder and most recently Ncontracts presentations on risk management, SOC 2 reports, Third party financials, and overall lifecycle for third party risk management remains a favorite as a resource to recommended to colleagues getting up to speed to assist with TPRM and due diligence within their business unit, etc.

For what your vendor can provide other than SOC2 and complete your cybersecurity / risk questionnaires, for AI vendors (directly or via their fourth parties), I am asking for CSA STAR Level 1, and STAR "Valid-AI-ted" Overview