Vendors you actually pay,
assessed and decided on record.
Third-party risk starts from what your organisation pays, so vendors that never went through procurement are found too. Every rating names its inputs, and every decision is recorded against a person and a date.
- No login
- Vendor portal needs no account or password
- Immutable
- Ratings, with their inputs named
- 4 reports
- Board Pack, Vendor Risk, Compliance, Programme
- On record
- Each decision against a person and a date
From a payment to a defensible decision
Each step leaves a record, so the decision can be explained later.
- 1
Discover
Vendors found from what you actually pay.
- 2
Check
Public sources read without emailing anyone.
- 3
Assess
Vendor answers through the portal.
- 4
Rate
Only accepted answers produce a rating.
- 5
Decide
Recorded against a person and a date.
- 6
Monitor
Continuous, after the decision.
Discovery
Find the vendors your register does not know about
Upload your Accounts and Purchase lists, or ask suppliers for them through a secure link. Netra shows only the vendors missing from your register.
- Built from what the organisation pays, not from memory
- A materiality bar keeps small spend recorded and reportable, but out of the way
- Nothing is added to the register until someone reviews it
Discovery, in practice
Checks and assessment
Facts found, answers confirmed
Public-source checks read a vendor's legal identity, certificate hygiene, claims and sub-processors without emailing anyone. Vendors then answer through a portal, one section at a time.
- Answers Netra found publicly are offered for the vendor to confirm, never submitted for them
- The vendor portal needs no account and no password
- Sub-processors are recorded, so fourth parties are visible too
Ratings and decisions
Ratings you can defend, decisions on record
Each rating is recorded against a person and a date, with its inputs named. Logged issues never silently change a rating. The decision itself is approve, approve with conditions or reject.
- A Decision Brief behind every approval
- An action queue that separates what needs your decision from what is waiting on others
- Continuous monitoring once a vendor is approved
The overview
The whole vendor programme on one page
The overview answers the questions a risk committee opens with: how many vendors, how many are covered, what they cost, and who is weak.
Vendors
How many are live, and how many are covered by an assessment.
Contract value
What the programme spends, so risk can be read against exposure.
Action queues
New risk, rating changes and weak compliance, each in its own queue.
Ratings
Where vendors stand, and where they are weak.
Dependencies
The parties your vendors rely on in turn.
Reports
Four report types, ready for the board and the regulator.
The register
Every vendor, with the facts a decision needs beside the name
Tier, category, rating, residual risk, the person who owns the relationship, the next reassessment date and what the contract is worth. A vendor without a tier is visible as a gap rather than quietly skipped.
- Netra · Third Party Risk · Vendor register
One row, enough to act on
The register is the working list, not a report. Tier drives how deep the assessment goes and how often it repeats, the owner is a named person rather than a department, and the annual value is there because a vendor you cannot leave in under sixty days is a different decision from one you can.
Vendors have vendors
A weak link two steps away is still your risk
Your contract is with the vendor. The vendor’s contract is with somebody else. The dependency map draws that second step, and marks every provider more than one of your vendors relies on.
- 1YouThe organisation, and the only party you actually hold a contract with on this picture.
- 2Your vendorsThe suppliers you assess, rate and decide on. Their grade is here because a weak vendor with many dependencies is a different problem from a strong one.
- 3Who they depend onRead from each vendor’s own published sub-processor list, or detected on their site. You did not choose these and you cannot assess them.
- 4Shared, and therefore concentratedAn amber line means more than one of your vendors leans on the same provider. That is the single point of failure to raise with the board, not the individual ratings.
Four of these providers carry more than one of your vendors. If one of them has a bad day, every vendor on that line has a bad day with it, and your recourse is with none of them. That is the concentration a vendor-by-vendor review never shows, because each vendor on its own looks fine. Each party is held with its country, which of your vendors use it, and how it was found: taken from the vendor’s own published sub-processor list, or detected on their site. When a vendor adds one after approval, it arrives in your queue rather than in a PDF nobody read.
Before you ask them anything
What the vendor already publishes, read and labelled
Netra reads the vendor’s own public pages and the public registers, then labels what it finds. A fact is independently true. An obligation is something they are legally bound to do. A claim is the vendor asserting something. Nothing is emailed, and nobody at the vendor is asked.
- Netra · Third Party Risk · Public profile signals
Claim, fact or obligation, each with its source
A trust centre page is a claim. A CSA STAR self-assessment is their own declaration, not independent assurance. Being an SEC-registered filer is an obligation, so material incidents must be disclosed within four business days. A certificate footprint read from Certificate Transparency is a fact. Every line carries a source link and the date it was read, so the picture ages visibly rather than quietly.
Then ask, once
The questions that fit this vendor, not a questionnaire for everyone
A library of assessments by purpose, from a six-question impact screen to an eighty-four question AI vendor review, alongside the ones your own organisation writes. Each section carries a weight, and each question can be marked for what the vendor must provide.
- Netra · Third Party Risk · Assessment library
Fit the depth to the vendor
Six questions for a vendor that touches nothing. Eighty-four for one that processes personal data with a model behind it. Sector and client-specific sets sit beside the Netra ones.
- Netra · Third Party Risk · Inside an assessment
Weighted, attestable, and specific
Sections carry weights, so identity and access counts for more than the general questions. Marking a question attestable means an answer alone will not do: the vendor must attach evidence, a written note or a reference.
The moment of decision
What accepting this assessment would mean, before you accept it
- 1The rating it would produceA grade and a score out of a hundred, with the share that came from the vendor’s answers against the share from public checks.
- 2Posture, and the likelihood behind itThe security posture score and the likelihood it implies, so the rating is not a single opaque letter.
- 3Where to look firstHow many sections fall below sixty. This is the list the reviewer should read before anything else.
- 4What is still unansweredUnanswered questions and how many answers arrived with an evidence file attached. An assessment with nothing attached is an opinion.
Accepting an assessment moves a rating, and a rating drives a decision. Netra shows what it would move to, and on what, before anyone clicks.
Where the risk actually is
Scored by domain, worst first, with the evidence behind each answer
- 1Weighted, not averagedIdentity and access carries twice the weight of the general questions, so a weak answer there moves the score more than a weak answer elsewhere.
- 2How many answers are weakAnswered is not the same as satisfactory. Each domain shows how many of its answers are weak, which is the number a reviewer actually works from.
- 3Stated, or shownEvery answer is marked vendor stated or backed by an attached file. An assessment where everything is merely stated is an opinion with a score on it.
- 4The reply is on the recordWhere you push back and the vendor answers, the exchange stays on the question rather than in somebody’s mailbox.
Not an average. Each domain carries its weight, shows how many of its questions were answered and how many of those answers are weak, and the list is ordered worst first. Open one and every answer is marked vendor stated or backed by a file, the vendor’s reply is on the record, and where you will not accept a statement again you tick evidence next time so the next round asks for proof.
Not a silo
Vendor work credited to the frameworks that ask for it
Third-party risk is a control requirement in most frameworks, and the work you do here answers it. Netra scopes the supplier controls per framework and shows what the programme has actually answered.
- Netra · Third Party Risk · Framework coverage
Per framework, in scope and answered
GDPR, HIPAA Security, HITRUST and ISO 27001 each define what they expect of suppliers. Pick one and the supplier controls it puts in scope are listed with their status, from A.5.19 on information security in supplier relationships through to A.5.23 on cloud services. The figures are per-framework views of one pool of work, so they do not add up and are not meant to.
After approval
Approval is a date, not a conclusion
- 1Checks keep runningThe public profile is re-read nightly. When a vendor changes what it publishes, that change comes to you rather than waiting for the next review.
- 2The next review is already bookedReassessment is scheduled against the tier, so a Tier 1 vendor does not quietly go three years without being looked at.
- 3New sub-processors are raisedA vendor adding a sub-processor is a change to your supply chain. It arrives as an item with an owner and an age, not as a line in a PDF nobody read.
Most vendor risk is written once and never looked at again. Here the public checks keep running and the next reassessment already has a date.
The vendor record
The commercial facts beside the risk ones
- Netra · Third Party Risk · The record
Renewal, notice period and exit, on the same record as the risk
The notice period is the reason a vendor decision has a deadline. A contract that auto-renews in sixty days with no exit plan is a different conversation from one you can leave in a month, and both facts sit beside the risk rating rather than in somebody’s inbox.
The decision
A brief that says how much of this you actually verified
- Netra · Third Party Risk · Vendor decision brief
Read-only, because the decision is yours
The provenance mix is the line that matters: how many answers the vendor merely stated against how many were confirmed. The system suggests approving with conditions and says so plainly, the brief notes that no certificate here is attested by an auditor, and the decision itself is taken on the vendor, by a person.
What comes out of it
Four reports, four audiences
- Netra · Third Party Risk · Reports
The same programme, said four ways
One vendor, defensible, for the file. Four numbers that matter, for the board. Per framework with evidence, for the auditor. Coverage, concentration and throughput, for the people running it.
Third-Party Risk in numbers
- 4 reports
- Board Pack, Vendor Risk, Compliance and Programme
- No login
- Vendors answer through a portal with no account
- 3 months
- Every board number carries its direction against three months before
- Fourth parties
- Sub-processors read from published lists
The Board Pack
A short pack that ends with decisions
The Board Pack is three pages. It reports outcomes, not activity, and says what it does not claim.
- 1Four numbersExposure, coverage, remediation within SLA and concentration, each with its direction.
- 2Where the money isSpend by contract in its own currency. Nothing is converted or combined.
- 3ConcentrationThe shared dependency behind several vendors, and who relies on it.
- 4Where the exposure isHighest residual risk first, what it holds up and who owns it.
- 5Decisions for the boardEach with an owner, a date and what happens if it is deferred.
- 6Compliance postureThird-party controls by framework, worst first.
- 7How we knowRatings combine vendor answers with independent checks. External signals prompt a review and never change a score on their own.
Why it matters
Vendor risk that holds up when questioned
A vendor that was never rated is not a safe vendor. Netra keeps that visible.
The usual way
- Vendors known from the contracts register, and from memory
- Questionnaires emailed and chased
- Ratings edited as opinions change
- A coverage number that flatters the programme
In Netra
- Vendors found from what the organisation actually pays
- A portal where vendors answer, with no account needed
- Ratings that name their inputs and cannot be changed quietly
- Unrated vendors counted, so coverage is honest
Who uses it
What else is in Third-Party Risk
Action queue
Your decisions first, other people's actions separately.
Nothing changes quietly
Logged issues never silently change a rating.
Fourth parties
Sub-processors recorded alongside each vendor.
Continuous monitoring
Vendors watched after the decision, not only before it.
Decision Brief
The reasoning behind each approval, kept on record.
Linked to your risks
Vendor risk sits on the same record as the rest of your risk register.
Works on the same record as
A task completed anywhere in Netra shows up here. Nothing is collected twice.
Questions about Third-Party Risk
How does Netra manage third-party and vendor risk?
Netra finds vendors from what Accounts and Purchase actually pay, runs public-source checks, sends assessments through a vendor portal and records each decision with a rating you can defend.
How does Netra find vendors we do not know about?
You upload the lists Accounts and Purchase already keep, and Netra shows only the vendors missing from your third-party register. The uploaded file is not stored, and columns holding bank details, account numbers or employee data are refused before anything is read.
How do vendors answer our assessments?
Through a vendor portal, one section at a time with progress always visible. Where Netra has read something publicly, the answer is offered as a suggestion the vendor confirms or changes. It is never submitted on their behalf.
Why does a vendor show a dash instead of a rating?
Because no assessment has been accepted for it yet. A rating is produced only when you accept a questionnaire - public checks alone never score a vendor. The dash means we cannot say, which is different from a low score, and every report states it in those words rather than treating unrated as safe.
Our coverage is low and it looks bad in the Board Pack. Can we hide it?
No, and you shouldn't want to. Coverage is a statement about your programme, not your vendors - it is the honest answer to “how much of this portfolio can we speak for?”. Presenting a flattering figure that later turns out to have excluded the unassessed vendors is a much worse conversation. Use it to argue for the resource to close the gap.
What does “no independent check available” mean on a claimed certification?
That the claim can't be verified from public sources - many certifications simply have no public register. It is not a finding and not a gap. Ask the vendor for the certificate and record it under Certifications, where a verified certificate file carries real weight.
A public hygiene check came back clear. Are they secure?
It tells you five things about their public front door - email authentication, TLS, security headers, DNS and the domain record. It says nothing about their internal programme, and Netra labels it exactly that way. It contributes a small fixed share of the rating; the vendor's own answers are the overwhelming majority.
Why does “Don't know” score zero?
Because a control nobody can confirm is not a control. Treating “don't know” as neutral would let an uninformative questionnaire produce a comfortable score. Not applicable is handled differently - it is excluded from the domain total entirely, so it neither helps nor hurts.
What is the difference between approving and approving with conditions?
A plain approval records your decision and starts the reassessment clock. Approving with conditions does the same and creates each condition as a tracked remediation with an owner and a due date. The vendor is not approved until those items exist, so the promise cannot quietly evaporate.
Does logging an issue change the vendor's rating?
No. Issues annotate the risk story - they never recompute the rating. A rating is a frozen statement about a moment; an incident is a fact recorded against the vendor that appears on the Decision Brief and in reports, and informs the next assessment.
What is a fourth party, and why does Netra care?
A fourth party is your vendor's vendor - read from your vendor's own published sub-processor list. They matter because of concentration: the same cloud provider sitting behind four of your suppliers is one shared point of failure, not four independent ones, and it will not show up anywhere in a vendor-by-vendor view.
Do we have to map business functions?
No - every dependency screen works with none mapped. But it is the cheapest high-value work in the module: it turns “this vendor is risky” into “this business process is exposed”, which is the sentence a board acts on. Start with two or three critical processes.
Which report do I give the board?
The Board Pack - three pages, four numbers, and a decisions section with owners and dates. The Programme Report is the operational version for you, the Compliance Report is for an auditor, and the Vendor Risk Report is for defending one vendor to a regulator or a client.
Can I run a report for a past period?
Yes. Set the reporting period and the report shows the position as it was, counting each rating exactly as published on or before that date. Nothing is recomputed, so a pack you run for last quarter reports last quarter.
See Third-Party Risk on your own frameworks
A demo with your frameworks and your kind of organisation, not a generic tour.
Next module: Asset Management