Vendor Risk Complete

The programme and the operating layer, which only work as a pair.

TPRM Program Kit — the design. The policy and charter, a seven-factor tiering model everything downstream computes from, a 150-question bank across 15 domains with Q20 and Q60 as tested subsets, 20 contract clauses with a negotiation fallback ladder, the monitoring cadence, an ERR-01-compatible register and fourth-party concentration scoring.

Vendor Risk Operations Kit — the running of it. The per-vendor dossier, a quarterly scorecard whose PREFERRED / WATCH / AT RISK rating carries consequences, an annual review that must end in a recorded decision, the vendor incident playbook, a tested exit plan for DORA Art. 28(8), an AI due-diligence overlay with hard stops, and the Register of Information builder with ten quality checks.

Why the pair. The operations kit assumes tiers exist, questionnaires have gone out and contracts carry the clauses — all of which the programme kit produces. Bought alone it is an operating layer with nothing underneath. Bought the other way round you have a designed programme that nobody runs after the first quarter, which is the more common failure and the harder one to notice.

Together they cover the two questions a supervisor asks in order: how do you manage vendor risk here, and what is the state of this vendor right now.

Delivered as two separate ZIP downloads.