Risk and Compliance
Third party risk management software: where AI collects evidence and people decide
A plain guide for risk, compliance and procurement leaders: what third party risk management covers, why the evidence is the slow part, where AI agents help, and what must stay with a named person. Kriv AI does not sell third party risk software; we help you design, configure and govern the work.
Third party risk management is how an organization decides which vendors it relies on, checks them before it signs, and keeps watching them afterward. The slow part is evidence: questionnaires, reports and contract terms that must be collected and read. AI agents can gather and summarize that evidence, but your risk team still makes every rating and approval.
what it is
What third party risk management covers
Third party risk management, often shortened to TPRM, is the practice of managing the risk that comes from the vendors, service providers and other outside parties your organization depends on. It asks a few steady questions. Which third parties do we use? How much would it hurt if one failed or was breached? What did we check before we signed? What are we watching now?
The clearest public description of the work comes from US bank regulators. The FDIC says the 2023 interagency guidance gives examples of considerations in the planning, due diligence, contract negotiation, ongoing monitoring, and termination stages of managing third-party relationships. That guidance is written for banks, so a hospital, insurer or manufacturer should check which rules apply to them. If your concern is physical suppliers and parts rather than vendors and software, see our guide to supply chain risk management. The five stages are still a useful way to organize the work in any regulated setting.
Software helps by keeping an inventory of vendors, tracking each one through those stages, and storing what was collected. AI agents add something different. They do the reading, which is where much of the time goes.
evidence
What evidence gets collected, and why it is slow
Third party risk evidence is what every vendor review rests on. Typical items are a completed security questionnaire, an independent security or controls report, insurance and financial documents, the contract and its data-handling terms, a list of the vendor's own subcontractors, and notices of past incidents. Each arrives in a different format, from a different person, on a different date.
Collecting it is mostly chasing. Reading it is mostly comparing: does the answer in the questionnaire match the report, does the contract say the same thing as the policy, is the certificate still in date. Your analysts do this work for each vendor, and again at each renewal.
Some evidence will never arrive. In the Federal Register preamble to the interagency guidance, some commenters said third parties or their subcontractors may be unable or unwilling to disclose certain information. A good process records that gap and the decision made about it, instead of leaving it unwritten.
tiering
Not every vendor needs the same depth of review
The agencies' preamble to the interagency guidance notes that "not all third-party relationships present the same level or type of risk and therefore not all relationships require the same extent of oversight or risk management." A catering supplier and a company that processes your payments should not get the same review.
The guidance applies the same logic after signing: "more comprehensive or frequent monitoring is appropriate when a third-party relationship supports higher-risk activities, including critical activities." Tiering vendors by how critical they are decides how much evidence you collect and how often.
Tiering is a judgment about your own business. An AI agent can propose a tier from the facts in the intake form. A named person decides it.
ai roles
Who decides, AI or a person
| Task | What AI agents can do | Who decides |
|---|---|---|
| Vendor intake and tiering | Read the intake form, list the facts, suggest a tier with the reasons | Risk owner sets the tier and can overrule the suggestion |
| Evidence collection | Send approved requests, track what is outstanding, and file what arrives | Analyst approves the request list and any escalation |
| Evidence reading | Summarize each document and point to the passage behind every statement | Analyst confirms the summary against the source |
| Gaps and exceptions | Flag missing, expired or conflicting evidence and draft an exception note | Risk owner accepts, rejects or escalates the gap |
| Ongoing monitoring | Watch for expiring documents and new notices, and queue a review | Analyst decides whether the new facts change the rating |
| Rating, approval and exit | Nothing on its own | Named approver signs off; the business owner decides on termination |
checklist
What to look for when choosing third party risk management software
1. A vendor inventory that matches how you work
One record per vendor with an owner, a tier, the services provided and the contract dates. If the inventory is wrong, everything built on it is wrong.
2. Evidence stored with its source
Every document kept with who sent it, when, and for which review, so a reviewer can go from a conclusion back to the page it came from.
3. Sources shown for every AI summary
Each summary or flag should link to the exact passage behind it. If a tool cannot show its source, an analyst cannot check it.
4. A person in the loop by design
No rating, approval or request to a vendor goes out without a named person approving it, and the tool records who approved what.
5. Gap and exception handling
A clear place to record evidence that is missing or refused, who accepted the risk, and when it will be looked at again.
6. An audit trail you can export
Requests, edits, approvals and decisions kept in a form your audit and compliance teams and your regulators can review without the software vendor.
7. Honest measurement
Agree up front how you will measure review time and review quality against your own baseline, rather than relying on vendor benchmarks.
governance
Keeping AI-assisted vendor review auditable
Treat each AI agent in the review process as a system with an owner. Write down which documents it may read, what it is allowed to suggest, who reviews its output and how it is monitored. Keep a record of every suggestion and every human decision, because that record is what your auditors and regulators will ask to see.
Vendor evidence can hold confidential security detail, so give agents the least access they need and log what they opened. Where a vendor handles protected health information, your compliance team sets the data-handling requirements, and the delivery should be HIPAA-aware. Our page on AI model risk and vendor due diligence covers the narrower question of assessing AI vendors specifically.
not first
What we do not recommend automating first
Do not start with anything that assigns a risk rating, approves a vendor or ends a relationship without a named person deciding. Do not start with agents that send requests to vendors with no one approving the wording. Both put the model in the decision seat.
Start where a person already checks the output: tracking outstanding requests, summarizing documents with their sources, and flagging expired or conflicting evidence. You learn how accurate the agents are on your own vendor files before anything reaches a vendor or a rating.
how kriv helps
How Kriv AI helps with third party risk evidence
Kriv AI is an AI implementation and governance consultancy. We do not sell third party risk management software and we do not publish client results for this work. We help your team design, configure and govern the process you run.
1. Map the current review
We follow a vendor through intake, due diligence, renewal and exit as it runs today, and find where the hours and the gaps actually are.
2. Choose what to build or buy
We compare the options against the checklist above and your existing tools, and say plainly where what you already have is enough.
3. Design the human review
We write who approves each agent action, what is recorded, how sources are shown and how gaps are escalated.
4. Pilot on your own vendor files
A limited pilot with analysts in the loop, measured against your own baseline before anything scales.
5. Hand over and govern
Your team owns the workflow, the review rules and the audit trail. Engagements are scoped and priced after a short discovery call.
Sources
Cited sources
- OCC, FDIC and Federal Reserve, Interagency Guidance on Third-Party Relationships: Risk Management, Federal Register, June 9, 2023
- FDIC, Financial Institution Letter FIL-29-2023, Interagency Guidance on Third-Party Relationships: Risk Management
- OCC Bulletin 2023-17, Third-Party Relationships: Interagency Guidance on Risk Management
Related resources
Continue exploring
Straight answers
Frequently asked questions about Third party risk management software: where AI collects evidence and people decide
What is third party risk management software?
It is software that keeps an inventory of your vendors, tracks each one through planning, due diligence, contract, monitoring and exit, and stores the evidence collected. Newer tools add AI to read documents and chase requests faster. Your risk team still decides each rating and approval, and should be able to see where every AI summary came from.
What is third party risk evidence?
It is the material you rely on to judge a vendor: questionnaires, independent security or controls reports, insurance and financial documents, contract terms, subcontractor lists and incident notices. The review is only as good as this file, so each item should be stored with its source, its date and the review it supported.
Can AI do vendor due diligence?
AI agents can do much of the collecting and reading: tracking requests, summarizing documents with their sources, and flagging gaps or conflicts. They should not decide. Due diligence ends in a judgment about whether to rely on a vendor, and that judgment belongs to a named person who can explain it to an auditor.
How is this different from AI vendor due diligence?
This page is about reviewing any vendor, using AI agents to speed up the evidence work. Our page on AI model risk and vendor due diligence is narrower: it covers how to assess vendors that sell AI. The two overlap when an AI vendor is also one of your third parties, but the questions asked are different.
Which vendors need the deepest review?
The ones whose failure would hurt most. The interagency guidance says not all relationships present the same level or type of risk, and that more comprehensive or frequent monitoring fits higher-risk and critical activities. Tier vendors by how critical the service is, then set evidence depth and review frequency by tier.
How do you keep AI-assisted vendor review auditable?
Each AI agent gets an owner, limited access to documents and a log of what it read and suggested. Every summary links to its source passage, and every human approval is recorded. The aim is a file your internal audit team or a regulator can follow from a rating back to the evidence without the software vendor.
Does Kriv AI sell third party risk management software?
No. Kriv AI is an AI implementation and governance consultancy. We help you compare options, configure the tool you choose, design the human review and the evidence rules, and pilot it on your own vendor files. Engagements are scoped and priced after a short discovery call.
Talk to the team that would do the work
Bring your requirements to a working session with the person who'll actually deliver.
Book a Discovery Call