Vendor reviews, sized to the risk.
Most of a vendor review is reading their documents and checking them against their answers. TruOps does the reading and shows you what needs a closer look.
| Vendor | Tier | Questionnaire | Claims vs. evidence | Risk |
|---|---|---|---|---|
| DataTemp Inc | Critical | SIG Lite · in portal | 1 contradiction | 7.8 |
| Payroll Co | High | SIG Core · complete | consistent | 5.1 |
| Design SaaS | Moderate | 12 questions · complete | consistent | 3.2 |
| Swag Supplier | Low | screening only | n/a | 1.0 |
Start from a vendor's domain. TruOps tiers each vendor by the service and data involved, sends a questionnaire sized to that tier through a vendor portal, checks the answers against their SOC 2 report and scan results, and turns failed checks into findings with a recommended action. Each vendor gets one portal page with what to answer, what to fix, and their own files.
The challenge
TPRM tools made sending questionnaires easy. Reading, checking, and deciding is where programs still get stuck.
What you're probably using today
| What you use now | Where it falls short | With TruOps |
|---|---|---|
| TPRM portals and questionnaire factories | Lots of questionnaires going out, and a bottleneck when they come back. | Tiering, questionnaires sized to the risk, a first review by the agent, and answers checked against evidence. |
| BitSight or SecurityScorecard used as the review | A rating is a useful signal. It isn't a review of the vendor's files. | Use outside-in context, then run an assessment sized to the risk, with evidence. |
| Spreadsheets, shared drives, and email | Your program lives in folders named after last year's audit. Owners paste screenshots the week before fieldwork, and nothing is dated, so you can't show what was true last quarter. | Upload those same files. TruOps pre-fills the assessment from them, cites every answer, and keeps technical checks running so you have evidence for the whole period. |
Tier first, then send
Your payroll processor and your swag vendor shouldn't get the same 300 questions. TruOps tiers each vendor by the service it provides and the data it touches, starting with inherent risk and updating to residual risk as evidence comes in, then sizes the questionnaire to match.
Where your vendors overlap
Tie each vendor to the apps and processes it supports and patterns show up. Three critical apps may run on the same cloud provider. One payroll processor may touch both HR and Finance. TruOps shows that concentration on the vendor’s page, so you know a vendor’s full reach before an outage or a breach shows it to you.
One portal page for your vendors
Invite a vendor as a guest. No account is needed. They get one page with what to answer, the findings you chose to share, and their own files. They link their trust center or drag in their reports, and the agent fills in most of the questionnaire for them to confirm.
Before anything reaches you, the agent checks their answers against their own documents and hands back what disagrees. Vendors see only what you share with them. Your risk rating and notes stay with you.
- InviteScope an assessment to the vendor and invite them as a guest.
- AnswerThe vendor adds their files and the agent fills in what it can. They confirm those answers and finish the rest.
- CheckThe agent checks their answers against their own reports before they send, then reviews the evidence for you and flags anything weak.
- Share findingsShare the relevant findings in the portal. The vendor fixes them and uploads new proof, and the agent re-checks it.
- DecideAccept each finding, send it to be fixed, or add it to the risk register. The result includes a vendor risk score.
Answers, verified
The agent checks what a vendor tells you against their SOC 2 report and scan results and flags anything that doesn't match. Reassessments run on a schedule or kick off when a certificate expires or something changes.
How TruOps helps
- Start from a domain
- Outside-in scanning helps fill in the vendor's details and industry.
- Risk tiering
- Inherent tier from the service and data involved, residual tier once evidence comes in.
- Questionnaires sized to the risk
- SIG, CAIQ, or your own, sized to the vendor's tier.
- Vendor portal
- One page for each vendor: what to answer, what to fix, and their files.
- Answers checked against evidence
- Answers are checked against SOC 2 reports and scans, and conflicts are flagged.
- Findings go to your register
- Vendor findings keep their rating, evidence, and recommendation.
Questions
What is third-party risk management?
Third-party risk management (TPRM) means finding, assessing, and monitoring the risks your vendors and other outside parties bring. See What is TPRM?
Can vendors fill in questionnaires directly in TruOps?
Yes. Vendors join as guests with no account. One portal page shows their questions, the findings you share with them, and their files.
Which vendor questionnaires are supported?
Standard questionnaires like SIG and CAIQ, plus any questionnaire you upload, sized to the vendor's tier.
What if a vendor does not respond in time?
The assessor can take the assessment back, extend the deadline, or finish with the vendor's part marked incomplete. Nothing is submitted automatically.
Do we have to rip out the tools we already use?
No. TruOps connects to your cloud, identity, endpoint, vulnerability, and code tools. Spreadsheets, prior reports, and policies upload into the Data Room. If you're moving from a SOC 2 automation tool or an enterprise GRC suite, you bring over your frameworks, evidence, vendors, and risks.
Can we bring our existing assessments, control lists, and vendor files?
Yes. Upload workbooks, reports, policies, and vendor exports. TruOps turns them into structured questionnaires, controls, and risks, each linked to the file it came from, for you to review.
Related
Tier, assess, and check vendors without getting buried in questionnaires.
→LearnThird-party risk managementTPRM: managing the risks vendors bring.
→LearnVendor tieringSizing vendor oversight to vendor risk.
→PlatformAssessmentsCompliance, risk, vendor, and customer assessments in one place.
→RolesThird-party risk managerOne view of every vendor, with agents reading the evidence first.
→See it run on your own data.
Book 30 minutes with a GRC specialist. Bring a real document, like a SOC 2 report, risk register, or vendor list (redacted is fine), and we'll show TruOps AI working on it.