| name | third-party-risk |
| description | Assess third-party risks — vendor criticality tiering, due diligence, ongoing monitoring, contract safeguards, and exit planning. TRIGGER when: user says /third-party-risk or asks about vendor risk assessment.
|
| argument-hint | [relevant context] |
| user-invocable | true |
third party risk
Process
Step 1: Define Scope
Identify the boundaries of what to assess, who is involved, and what assets/processes are in scope.
Step 2: Identify Risks/Requirements
| Risk/Requirement | Category | Severity | Likelihood |
|---|
| [item] | [category] | H/M/L | H/M/L |
Step 3: Assess Current Controls
| Control | Effectiveness | Gap |
|---|
| [control] | Strong/Adequate/Weak | [description] |
Step 4: Prioritize Actions
| Action | Impact | Effort | Priority |
|---|
| [action] | H/M/L | H/M/L | P1/P2/P3 |
Step 5: Develop Mitigation Plan
| Risk | Mitigation | Owner | Timeline |
|---|
| [risk] | [strategy] | [name] | [date] |
Step 6: Monitor and Report
| Metric | Target | Frequency |
|---|
| [KRI/metric] | [threshold] | Weekly/Monthly/Quarterly |
Output Format
## third party risk: [Scope]
### Risk Summary: [Key findings]
### Controls: [Current state assessment]
### Recommendations: [Prioritized actions]
### Monitoring: [KRIs and reporting cadence]
Quality Checklist
Edge Cases
- For rapidly changing environments, increase assessment frequency
- If data is limited, use qualitative assessment with expert judgment
- For cross-organizational risks, coordinate with all affected parties
- Adjust methodology based on regulatory requirements
