How to Build a Third-Party Risk Management (TPRM) Questionnaire Workflow

Implement a TPRM questionnaire workflow that automates vendor security evaluations, standardizes risk scoring across control domains, and maintains the audit trail examiners look for under the Interagency Guidance on Third-Party Relationships: Risk Management (June 2023). That guidance is supervisory guidance, not a regulation, and it rescinded and replaced the Federal Reserve's SR 13-19 and OCC Bulletin 2013-29: each earlier guidance "is rescinded and replaced by this final guidance". In September 2026 the OCC, Federal Reserve, FDIC and NCUA proposed new third-party risk management guidance; it is a proposal, with comments due November 16, 2026, and "Any finalized guidance would replace the 2023 Guidance". Until then the 2023 guidance is the current text (interpretation). Map questions to established frameworks like NIST or ISO 27001, configure weighted scoring algorithms by vendor classification, and design multi-stage review workflows with automated escalation timers.

Step 1: Define Risk Categories and Control Domains

Start by establishing the security control framework that will structure your questionnaire. Map your questions to established frameworks such as the NIST Cybersecurity Framework, ISO/IEC 27001, or the criteria a SOC 2 report covers. This example uses five risk categories:

• Data Protection: Encryption standards, data classification, retention policies
• Access Management: Multi-factor authentication, privileged access controls, identity governance
• Infrastructure Security: Network segmentation, endpoint protection, vulnerability management
• Incident Response: Detection capabilities, response procedures, business continuity planning
• Governance: Security policies, compliance certifications, third-party assessments

Within each category, define 15-25 specific control objectives. For example, under Data Protection, include controls for PCI DSS compliance for payment card data and for encryption of data at rest with cryptographic modules validated under FIPS 140-3. NIST's Cryptographic Module Validation Program moved FIPS 140-2 validations to its historical list in September 2026, though it "supports the purchase and use of these modules for existing systems". This granular approach enables precise risk scoring and identifies specific remediation requirements.

Step 2: Build the Questionnaire Structure

Design the questionnaire with consistent question formats and response scales. Use a four-point maturity scale for each control:

• Level 1 (Ad Hoc): No formal process or documentation exists
• Level 2 (Developing): Basic processes exist but lack consistent implementation
• Level 3 (Defined): Documented processes with regular execution and monitoring
• Level 4 (Optimized): Mature processes with continuous improvement and automation

Structure questions to require specific evidence. Instead of asking "Do you have incident response procedures?", ask "Provide your incident response playbook including escalation thresholds, communication templates, and recovery time objectives for data breaches affecting customer information."

Create conditional logic for follow-up questions. If a vendor indicates they process payment card data, automatically trigger PCI DSS-specific questions about vulnerability scanning, penetration testing, and compensating controls documentation.

Step 3: Establish Vendor Classification and Questionnaire Assignment

Develop a vendor classification system that determines questionnaire complexity and review frequency. Base classifications on three factors:

Data Sensitivity Level:

• Level 1: Public information only
• Level 2: Internal business data
• Level 3: Confidential customer data
• Level 4: Regulated data (PCI, PHI, PII)

Business Criticality:

• Low: Outage has minimal business impact

Access Level:

• Network access to production systems
• Remote access capabilities
• Administrative privileges
• Read-only access to applications

High-risk vendors (Level 4 data + Critical business impact + Network access) receive comprehensive 200-question assessments annually. Medium-risk classifications fall between these extremes with 100-150 questions reviewed annually. Tiering this way follows the 2023 interagency guidance: "The scope and degree of due diligence should be commensurate with the level of risk and complexity of the third-party relationship."

Step 4: Configure Automated Scoring and Risk Calculation

Implement a weighted scoring algorithm that converts questionnaire responses into quantitative risk scores. Assign point values to each maturity level:

• Level 1 (Ad Hoc): 1 point

Apply control domain weights based on vendor classification.

Calculate the overall risk score using this formula:

Risk Score = Σ (Control Domain Score × Domain Weight) / Maximum Possible Score × 100

Establish risk thresholds that trigger specific actions:

Step 5: Design the Review and Approval Workflow

Create a multi-stage workflow that routes questionnaires through appropriate stakeholders based on risk scores and vendor classifications. Configure the following approval stages:

Stage 1 - Technical Review: Information security team validates responses and requests supporting documentation. Review includes verification of SOC 2 reports, ISO 27001 certificates and PCI DSS compliance documentation and assessment of technical controls adequacy.

Stage 2 - Risk Assessment: Risk management team reviews scoring methodology, validates risk calculations, and documents any accepted residual risks. They also confirm that control gaps align with institutional risk appetite.

Stage 3 - Business Approval: Business unit owners review risk summary and approve vendor engagement. High-risk vendors require additional approval from the Chief Risk Officer or designated risk committee.

Set automatic escalation timers for each stage: 5 business days for technical review, 3 business days for risk assessment, and 5 business days for business approval. Configure email notifications at 80% of allotted time to prevent delays.

Step 6: Implement Evidence Collection and Validation

Require vendors to submit supporting documentation for high-risk control areas. Create standardized evidence requirements:

• Penetration Testing: Executive summary, methodology description, remediation status for high/critical findings
• Compliance Certifications: Current SOC 2 Type II report, ISO 27001 certificate with scope statement
• Incident History: Security incident log for previous 24 months with impact assessment and resolution details
• Business Continuity: Disaster recovery plan, RTO/RPO documentation, annual testing results

Establish validation procedures for submitted evidence. Confirm that the CPA firm that issued a SOC 2 report is licensed, verify ISO 27001 certificates with the issuing certification body or its accreditation body, and check penetration testing firms' qualifications.

Step 7: Configure Monitoring and Reassessment Triggers

Establish automated triggers that initiate questionnaire updates between scheduled review cycles. Configure monitoring for:

• Security Incidents: News alerts, vendor notifications, or regulatory bulletins mentioning vendor security breaches
• Certification Changes: Expired or withdrawn SOC 2 reports, ISO 27001 certificates, or industry-specific compliance certifications
• Material Changes: Vendor mergers, acquisitions, infrastructure changes, or new service offerings
• Risk Score Degradation: Declining performance in other risk categories (operational, financial, reputational)

Implement a streamlined reassessment process that focuses on changed risk areas rather than complete questionnaire re-submission. Create delta questionnaires with 20-30 targeted questions addressing specific concerns identified through monitoring activities.

Step 8: Generate Reporting and Audit Documentation

Configure automated reporting that provides risk management committees and auditors with comprehensive TPRM program visibility. Generate monthly executive dashboards showing:

• Vendor population by risk classification
• Average risk scores by business unit
• Overdue assessments and approval backlogs
• Exception approvals and risk acceptance documentation

Create detailed audit trails that capture all workflow activities including questionnaire responses, evidence submissions, approval decisions, and risk score calculations. Maintain records to satisfy regulatory examination requirements.

Export capabilities should include vendor risk registers in multiple formats (PDF, Excel, CSV) with filtering options by risk score, business unit, vendor category, and assessment date ranges.

A comprehensive TPRM questionnaire workflow can reduce manual assessment time and improve risk identification and compliance (interpretation). The structured approach enables consistent vendor evaluations, facilitates risk-based decision making, and provides auditable documentation for regulatory examinations. Regular workflow optimization based on assessment results and regulatory changes maintains program effectiveness over time.