Lesson plan

Third-party risk with Vendor Risk Management

Run a third-party risk program in Vendor Risk Management (VRM), from inventory and tiering through due diligence, SOC report reviews, monitoring and issues to board and examination reporting.

Back to the course

Product: Vendor Risk Management (VRM)
Level: Practitioner
For: Users, Administrators
Total time: 2 hr 37 min
Lessons: 13 in 3 modules
Assessments: 4

Course objectives

Explain how the interagency third-party guidance's life cycle maps to the records and stages in Vendor Risk Management
Build and maintain a single vendor inventory with an accountable relationship owner for every third party
Tier vendors from inherent-risk answers and flag relationships that support critical activities
Request due diligence from vendors and handle overdue, missing and declined items
Review a SOC report on the structured template and assign complementary user-entity controls to owners
Follow expiring documents, reassessments, issues and contract dates through to a recorded outcome
Produce committee, board and examination reporting from the system of record

Before the course

A Moraph client account with a Vendor Risk Management role, such as relationship owner, specialist reviewer or third-party risk manager
A working knowledge of your institution's third-party risk management policy
Completion of Moraph foundations, or equivalent experience signing in to Moraph Apps

Module 1: Inventory and tiering (42 min)

Lesson	Type and time	Learners will be able to	Activity and assessment
Third-party risk and the interagency guidance	Reading 10 min	Describe the stages of the third-party relationship life cycle in the interagency guidance Match each life-cycle stage to the record types and stages in Vendor Risk Management Name the roles in Vendor Risk Management and what each is accountable for	Reading
Building the vendor inventory	Reading 12 min	Explain why a single, complete inventory is the foundation of the program Add a vendor through the vendor master import or by proposing a new relationship Resolve duplicates and retire vendors with a recorded reason Reassign a departing relationship owner's vendors without losing open work	Reading
Tiering vendors and flagging critical activities	Reading 12 min	Answer the inherent-risk questionnaire so it produces a defensible tier Explain how the tier drives due diligence, review frequency and reassessment Decide whether a relationship supports a critical activity and what that flag changes Handle a tier override or a policy change to review frequency	Reading
Module 1 knowledge check	Assessment 8 min	Check your understanding of the third-party life cycle, the vendor inventory and risk tiering	5 questions · pass mark 70% · unlimited attempts

Module 2: Due diligence and reviews (50 min)

Lesson	Type and time	Learners will be able to	Activity and assessment
Requesting due diligence from vendors	Reading 12 min	Send a document request to a vendor through a secure upload link Explain how reminders and escalation work when a vendor doesn't respond Record missing or declined items so the gap is visible Troubleshoot the most common request problems before raising a ticket	Reading
Reviewing SOC reports and assigning user-entity controls	Reading 15 min	Record a SOC report's type, scope, period, opinion, exceptions and subservice organizations on the review template Decide when a bridge letter is needed and request it Assign complementary user-entity controls to the control owners who operate them Move a review through specialist review and owner conclusion to completion	Reading
Practical: review a SOC 2 report	Practical exercise 15 min	Apply the SOC review template to a realistic report summary Turn exceptions and user-entity controls into issues and assignments	Practical exercise with a checklist
Module 2 knowledge check	Assessment 8 min	Check your understanding of due-diligence requests, SOC report reviews and user-entity controls	5 questions · pass mark 70% · unlimited attempts

Module 3: Monitoring, issues and reporting (1 hr 5 min)

Lesson	Type and time	Learners will be able to	Activity and assessment
Monitoring expiry dates and reassessments	Reading 12 min	Use expiry tracking and the Attention view to act before documents lapse Keep tier-based reassessments on schedule Explain how outside-in security ratings from Third-Party Risk Scoring complement periodic reviews	Reading
Issues, contracts and exit planning	Reading 13 min	Follow an issue from finding to closure with evidence, or to a recorded risk acceptance Use contract renewal-notice dates to make a deliberate renew, renegotiate or exit decision Keep exit and contingency plans current for critical relationships Retire a vendor at termination with its history intact	Reading
Board and examination reporting	Reading 12 min	Choose the right report for management, the board and examiners Prepare a committee or board pack from the system of record Give an examiner scoped, time-limited read-only access, or an examination request pack	Reading
Module 3 knowledge check	Assessment 8 min	Check your understanding of monitoring, issues, contracts and program reporting	5 questions · pass mark 70% · unlimited attempts
Final assessment	Assessment 20 min	Show you can apply Vendor Risk Management across the third-party life cycle, from inventory to examination	12 of 18 questions · pass mark 80% · 3 attempts

Completing the course

Every lesson must be completed: reading lessons are marked complete by the learner, exercises when every checklist item is confirmed, and assessments only when passed. Completing the course issues a certificate of completion with a verification code.