third-party-risk

name	third-party-risk
description	Assess third-party risks — vendor criticality tiering, due diligence, ongoing monitoring, contract safeguards, and exit planning. TRIGGER when: user says /third-party-risk or asks about vendor risk assessment.
argument-hint	[relevant context]
user-invocable	true

third party risk

Process

Step 1: Define Scope

Identify the boundaries of what to assess, who is involved, and what assets/processes are in scope.

Step 2: Identify Risks/Requirements

Risk/Requirement	Category	Severity	Likelihood
[item]	[category]	H/M/L	H/M/L

Step 3: Assess Current Controls

Control	Effectiveness	Gap
[control]	Strong/Adequate/Weak	[description]

Step 4: Prioritize Actions

Action	Impact	Effort	Priority
[action]	H/M/L	H/M/L	P1/P2/P3

Step 5: Develop Mitigation Plan

Risk	Mitigation	Owner	Timeline
[risk]	[strategy]	[name]	[date]

Step 6: Monitor and Report

Metric	Target	Frequency
[KRI/metric]	[threshold]	Weekly/Monthly/Quarterly

Output Format

## third party risk: [Scope]
### Risk Summary: [Key findings]
### Controls: [Current state assessment]
### Recommendations: [Prioritized actions]
### Monitoring: [KRIs and reporting cadence]

Quality Checklist

• Scope clearly defined
• Risks identified systematically
• Current controls assessed for effectiveness
• Recommendations prioritized by risk level
• Monitoring plan established
• Stakeholders reviewed findings

Edge Cases

• For rapidly changing environments, increase assessment frequency
• If data is limited, use qualitative assessment with expert judgment
• For cross-organizational risks, coordinate with all affected parties
• Adjust methodology based on regulatory requirements