Third-party risk management
Manage vendors from intake to offboarding in one workspace
Take vendors through intake and due diligence, assess their risk across security, privacy, financial and operational areas, and give them their own portal to answer questionnaires and upload evidence instead of an email thread and a shared folder.
In short
Certifyi replaces the vendor spreadsheet and the email chain with a lifecycle: intake, risk assessment, questionnaires, document collection and a vendor portal. Vendors log in to their own portal instead of sending files by email.
From intake to offboarding
Vendor risk starts before the contract is signed and continues after the project is delivered. Certifyi covers intake with risk tiering, periodic reassessment, document tracking and offboarding when the relationship ends.
- Intake. An intake form with risk tiering, due diligence steps and approval. The tier decides which assessments are required.
- Risk assessment. Assess each vendor across security, privacy, financial, operational and compliance areas, with criteria you set for each tier.
- Documents. Collect certifications, SOC reports and insurance certificates, with their expiry dates recorded.
- Relationships. Record whether an organisation is a supplier, an auditor or a client, and scope each engagement.
A portal for your vendors
Vendor reviews usually run on email: questionnaires as attachments, evidence in shared folders and responses tracked in a spreadsheet. In Certifyi, vendors log in to a portal where they answer questionnaires, upload evidence and see where their review stands.
They use the same portal for the whole relationship, so every response and document for that vendor is in one place.
- Vendor workspace. Vendors answer questionnaires, upload evidence, see their status and message your team.
- Engagement scope. Set which questionnaires, which period and which documents each engagement covers.
- Access that ends. A vendor’s access is tied to the engagement and ends with it.
Questionnaires in both directions
You send questionnaires to your vendors, and your customers send them to you. Certifyi has a builder for the ones you send and AI-drafted answers for the ones you receive.
- Questionnaire builder. Build your own questionnaires for vendors.
- Customer questionnaires. Answer incoming questionnaires from your control library.
- AI-drafted answers. AI drafts answers from your existing controls and evidence. You review and edit them before anything is sent.
Your DORA ICT third-party register
DORA requires financial entities to keep a register of their ICT third-party service providers and to report it to their supervisor in a set format. In Certifyi the register is held with your vendor records and exported as xBRL-CSV, the format supervisors ask for.
Because the register is built from the vendor records you already keep, you update it as part of normal vendor management and export it when the reporting date comes round.
- ICT register
- A record of your ICT third-party providers, the services they deliver and the contracts in place.
- xBRL-CSV export
- The machine-readable format European supervisory authorities use for DORA register reporting.
What vendor risk in Certifyi covers
Vendor risk in the same workspace as your controls, risks and frameworks.
-
Vendor portal
Vendors answer questionnaires, upload evidence and see their status in their own portal, not through email links or shared folders.
-
DORA ICT register (xBRL-CSV)
Export your DORA ICT third-party register as xBRL-CSV, from the vendor records you already keep.
-
AI-drafted answers
AI drafts questionnaire answers from your existing controls and evidence, for you to review before sending.
-
Risk tiering
The tier set at intake decides how much due diligence a vendor gets.
Related modules
Vendor work touches risk management (vendor risks in the risk register), compliance (vendor evidence for your controls), incidents caused by a supplier, and privacy (processors and sub-processors).
How Certifyi helps
Moving vendor management out of spreadsheets
A vendor lifecycle in Certifyi, with a portal your vendors log in to.
-
Risk tiering at intake
Classify each vendor at intake. The tier decides which due diligence steps apply, so high-risk vendors get more scrutiny.
-
Questionnaires
Build security questionnaires, send them through the vendor portal and track the responses.
-
Vendor portal
Vendors log in to answer questionnaires, upload evidence and see their status.
-
Vendor documents
Collect certifications, SOC reports and insurance certificates with their expiry dates.
-
DORA ICT register
If you are subject to DORA, export the ICT third-party register as xBRL-CSV.
Questions
Vendor risk questions
Do vendors need a Certifyi account?
Vendors get a login for the vendor portal. They do not need a full Certifyi licence, and the portal only shows their relationship with your organisation.
Can I use Certifyi to respond to customer questionnaires?
Yes. Customer questionnaires are answered from your control library. AI drafts answers that you review and approve before sending.
What is the DORA ICT register?
DORA requires financial entities in the EU to keep a register of their ICT third-party service providers and report it to their supervisor. In Certifyi you build that register from your vendor records and export your DORA ICT third-party register as xBRL-CSV when it is due.
Give your vendors a portal instead of an email thread
Start from your current supplier list. In a demo we take a few of those vendors through intake and the vendor portal, then export a DORA register from their records. Book one and bring the list.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them