← All capabilities

Third-Party Risk & Due Diligence

Understand the risk from your suppliers

Discuss this capability
Two people reviewing third-party cyber-risk and due-diligence evidence
Third-Party Risk & Due Diligence · specialist capability

How this capability helps

Supplier access and dependencies can expose your business to cyber risk.

Suppliers can hold your data, access your systems or support a service your business depends on. An acquisition also brings cyber risks, often before the buyer has enough evidence or contractual influence to address them.

Third-party risk work should identify the dependencies that matter most to the business. The assessment brings together technical evidence, contracts and business context, then considers changes that could affect the relationship.

01

What it covers

  • Supplier tiering, due diligence and monitoring
  • M&A cyber review and integration planning
  • Concentration, contract and fourth-party exposure
02

When this helps

  • The supplier register does not show who can access your systems and data
  • Questionnaire responses do not give you enough information to decide
  • A transaction or critical outsourcing decision is approaching
03

What you receive

  • An assessment of suppliers and dependencies based on their risk
  • Due-diligence findings that inform actions and deal decisions
  • Named owners for fixes, monitoring and decisions to accept risk

Where delivery can go wrong

Specialists need clear responsibilities and a way to resolve decisions that affect each other.

Problems arise when the right expertise is missing or nobody coordinates the work between specialists.

01

Relying on supplier statements

Supplier statements can help with an assessment, but may not show whether controls work today or how a recent compromise has affected them.

02

Assessing every supplier in the same way

A supplier with little business impact needs a different level of scrutiny from a processor holding critical data.

03

Making decisions under a deal deadline

Bring the evidence, contracts and technical review together in time to inform commercial decisions while terms can still be negotiated.

How the process works

Follow each stage to see the decisions and checks needed to complete the work.

The diagram opens with the whole process in view. Zoom in for detail, then drag or scroll within the frame.

Third-Party Risk & Due Diligence process diagram. A general third-party process: tier the relationship, apply proportionate diligence, decide how gaps are treated and close the assessment with a clear outcome and review trigger.
Read the process step by step
  1. New supplier, renewal or acquisition.
  2. Assess business impact and access to data or systems.
  3. Critical or high-risk?
    • If no: Complete standard evidence and contract review. Approved with review date.
    • If yes: Complete enhanced technical and commercial diligence. Continue to the next decision.
  4. Gaps acceptable?
    • If no: Remediate, add contract controls or reject.
    • If yes: Approve with obligations and exit terms.
  5. Record the outcome and monitoring trigger.
  6. Due-diligence cycle closed.
1

Business impact

Prioritise suppliers whose access or services could materially affect the business.

2

Evidence

Distinguish supplier claims and inherited certificates from current technical evidence.

3

Decision

Decide how to address each finding: fix it, add contractual controls, monitor it, accept the risk or walk away.

How Musketeers coordinates the work

Musketeers keeps the client and specialist teams working to the same plan.

Specialists deliver the technical work. Musketeers coordinates their involvement, tracks decisions and dependencies, and keeps the evidence available until the work is complete.

  1. 01Group dependencies by their impact on the business
  2. 02Review the commercial, technical and governance evidence together
  3. 03Track significant changes, fixes and decisions about risk