Skip to content

Moraph for clients

Sign in

Vendor Risk Management (VRM)

Third-party risk with Vendor Risk Management

Run a third-party risk program in Vendor Risk Management (VRM), from inventory and tiering through due diligence, SOC report reviews, monitoring and issues to board and examination reporting.

Practitioner2 hr 37 min13 lessonsFor Users, AdministratorsCertificate of completion

Lesson plan (printable)

About this course

Vendor Risk Management (VRM) keeps your institution's third-party inventory, risk tiers, due-diligence documents, reviews and issues in one place, so management, the board and examiners can see how each relationship is overseen. This course follows a relationship through its whole life in the product: proposing and tiering a vendor, requesting and reviewing its evidence, monitoring it while the contract runs, and reporting on the program as a whole.

The course is written for the people who do this work every day: third-party risk managers, relationship owners, specialist reviewers and control owners, and the administrators who set the product up. It teaches how the product supports the Interagency Guidance on Third-Party Relationships: Risk Management, but your own policy decides your tiers, review frequencies and approval authorities. Where the course shows tiers, vendors or reviews, they are fictional examples.

What you’ll be able to do

  • Explain how the interagency third-party guidance's life cycle maps to the records and stages in Vendor Risk Management
  • Build and maintain a single vendor inventory with an accountable relationship owner for every third party
  • Tier vendors from inherent-risk answers and flag relationships that support critical activities
  • Request due diligence from vendors and handle overdue, missing and declined items
  • Review a SOC report on the structured template and assign complementary user-entity controls to owners
  • Follow expiring documents, reassessments, issues and contract dates through to a recorded outcome
  • Produce committee, board and examination reporting from the system of record

Skills you’ll gain

  • Third-party inventory and tiering
  • Vendor due diligence
  • SOC report review
  • Complementary user-entity controls
  • Issue management and remediation
  • Board and examination reporting

Before you start

  • A Moraph client account with a Vendor Risk Management role, such as relationship owner, specialist reviewer or third-party risk manager
  • A working knowledge of your institution's third-party risk management policy
  • Completion of Moraph foundations, or equivalent experience signing in to Moraph Apps
  • Recommended first: Moraph foundations: technology for high-stakes work

Syllabus

3 modules · 8 readings · 1 practical exercise · 4 assessments

  1. Module 1Inventory and tiering

    1. Reading: Third-party risk and the interagency guidanceReading · 10 min
    2. Reading: Building the vendor inventoryReading · 12 min
    3. Reading: Tiering vendors and flagging critical activitiesReading · 12 min
    4. Assessment: Module 1 knowledge checkAssessment · 8 min

  2. Module 2Due diligence and reviews

    1. Reading: Requesting due diligence from vendorsReading · 12 min
    2. Reading: Reviewing SOC reports and assigning user-entity controlsReading · 15 min
    3. Practical exercise: Practical: review a SOC 2 reportPractical exercise · 15 min
    4. Assessment: Module 2 knowledge checkAssessment · 8 min

  3. Module 3Monitoring, issues and reporting

    1. Reading: Monitoring expiry dates and reassessmentsReading · 12 min
    2. Reading: Issues, contracts and exit planningReading · 13 min
    3. Reading: Board and examination reportingReading · 12 min
    4. Assessment: Module 3 knowledge checkAssessment · 8 min
    5. Assessment: Final assessmentAssessment · 20 min

What completion gives you

Complete every lesson and pass each assessment to complete the course. You then get a completion record in My learning, and a certificate of completion you can print or share, with a code anyone can check at academy.moraph.com/verify.

Completion is not certification

Course completion records and certificates of completion show that a person completed a Moraph Academy course. They are not a Moraph certification (which needs the certification exam), a professional license or an accreditation, and they do not authorize anyone to configure, operate, resell or support Moraph products on Moraph’s or anyone else’s behalf.

Course updates

  • Version 1 · · First version.