Signs your TPRM program has outgrown spreadsheets

An examiner's first request is the list. Under the guidance's Documentation and Reporting section, the lead example of effective documentation is "a current inventory of all third-party relationships (and, as appropriate to the risk presented, related subcontractors) that clearly identifies those relationships associated with higher-risk activities, including critical activities." Note the word current. A list reconciled once a year against accounts payable is not current, and an inventory split between procurement's tracker, InfoSec's SaaS list and a shared inbox is not one list.

You will know this sign by the question that follows it. "Is Northwind on the list?" takes a meeting to answer. Someone searches three files and an email thread, finds two entries with different owners, and nobody can say whether the subcontractor it uses for hosting was ever screened.

What it costs is the gap between the vendors you manage and the vendors you have. Every third party in that gap was never tiered, never screened and never assessed, and in a breach it is the one you learn about from the vendor's lawyer. The fix is structural rather than clerical:

• One inventory, with every other list retired or made read-only.
• An owner, a risk tier, a criticality flag and a lifecycle status on every row.
• Fed by intake, never by a quarterly sweep of invoices.
• Before writing "merge the spreadsheets" as the fix, read the next six signs.

Every vendor risk assessment template has a scoring tab, and every scoring tab has a column of judgment calls. Inherent risk: high, medium or low. Data sensitivity: a dropdown. Criticality: whatever the business owner wrote on the intake form. Two careful reviewers reading the same SOC 2 will land a notch apart, and in a spreadsheet nothing reconciles them.

Tiering carries the whole life cycle in the guidance, which expects "more comprehensive and rigorous oversight and management of third-party relationships that support higher-risk activities, including critical activities." NYDFS Part 500 makes the same demand of covered entities: third-party policies must address "the identification and risk assessment of third-party service providers" and "periodic assessment of such third-party service providers based on the risk they present" (section 500.11(a)). A tier that moves with the reviewer breaks both. The critical vendor that scored one notch low gets the light review, and the examiner who samples ten files finds the inconsistency in the first three.

Fix the method before the tool. Write the scoring rules down as rules, weight them, and decide which single answers force a tier regardless of the total:

• Data classes the vendor touches, and whether any of it is customer or nonpublic information.
• Access type: network, system, physical or none.
• Spend band, geography and how easily the vendor could be substituted.

A spreadsheet can hold those rules in formulas, and that is a reasonable interim step. What it cannot do is apply them to every vendor automatically, log who overrode the result and why, or re-score when an input changes. That is the point at which the template has to become a workflow.

Every policy says continuous monitoring. Open the workbook and look for the column that changed last week. The guidance is specific: ongoing monitoring exists to "escalate significant issues or concerns, such as material or repeat audit findings, deterioration in financial condition, security breaches, data loss, service interruptions, compliance lapses, or other indicators of increased risk," and it may run "on a periodic or continuous basis," with more frequent monitoring where critical activities are involved. A spreadsheet can only be updated by a person, so in practice the frequency is however often someone remembers.

What that costs shows up as lag. A security rating slides for two months before the annual questionnaire catches it. A supplier's going-concern qualification sits in its filings long before it reaches your sheet. A sanctions designation lands on a vendor's owner and nobody re-screens until renewal. Certa's guide to continuous monitoring priorities starts from the KPIs tied to your business goals and the regulations that apply to you, and for most programs the honest sequence is the critical tier first, across cyber, financial and sanctions, before anything else.

• Data: ratings, financial health, adverse media and watchlists arriving without a request.
• Thresholds: one per signal, written down, that opens a review when crossed.
• Owner: a named person who receives the review, not a distribution list.

Without the second and third parts, a feed is just another tab.

Onboarding is where the spreadsheet's hidden costs become visible to the rest of the company. A request arrives by email. Procurement keys it into the tracker, InfoSec sends its questionnaire, legal reviews the contract after InfoSec is done, and finance validates banking details after legal is done. Each handoff waits in someone's inbox. Certa's procurement page describes the result plainly: "a single high-risk vendor stalls an entire onboarding queue for weeks."

The business does not wait. It signs anyway, pays through an expense report, or picks a vendor already in the system regardless of fit, and each of those is a control failure the spreadsheet caused by being slow. Measure cycle time from request to approved, by tier, and compare it with what the sequence of reviews actually requires. The difference is queue time, and queue time is what tprm tools remove.

Three categories of tooling get sold as the answer, and they are not the same thing. Certa's infographic on automation vs orchestration vs AI draws the line between them. Automation does a single task without a person, orchestration sequences many tasks and teams on one record, and AI makes the judgment calls that used to need an analyst. Onboarding cycle time is mostly an orchestration problem. One US manufacturer took supplier onboarding from 6 to 12 months to 4 weeks on Certa, and Uber reported on-time supplier payments up from 40% to 95% with a six-week rollout and 50% lower operating costs.