Getting started with Vendor Risk Management (VRM)

Vendor Risk Management keeps your third-party inventory, risk tiers, due-diligence documents and reviews in one place. It requests SOC reports, insurance certificates and questionnaires from vendors, tracks what expires and when, and records each review, finding and follow-up so management, the board and examiners can see how every relationship is overseen.

What it is for

Regulators expect banks and credit unions to manage the risk of every third party across its whole life: before the contract, while it runs and when it ends. In many institutions that evidence is spread across spreadsheets, shared drives and email, so it is hard to show an examiner what was reviewed, by whom and what happened next.

• The vendor list in accounts payable rarely matches the list the risk team is overseeing.
• SOC reports and insurance certificates arrive by email, are filed inconsistently and expire unnoticed.
• Exceptions in a vendor's SOC report and the controls your institution must operate itself are not tracked to an owner.
• Board and examiner reports are assembled by hand each time they are requested.

Who uses it

• Third-party risk managers who run the oversight program
• Procurement and vendor managers who own each relationship day to day
• Information security, privacy and business continuity reviewers
• Compliance and internal audit teams
• Boards and risk committees that oversee third-party risk

Before you start

• Your organization licenses Vendor Risk Management (VRM) from Moraph.
• A Moraph client account in that organization, signed in.
• Access to Vendor Risk Management (VRM) in Moraph Apps, given by an administrator in the Moraph Portal under People and access.
• For setup: the product administrator role.

Steps to get started

1. Sign in at app.moraph.com with your Moraph account.

2. Open Vendor Risk Management (VRM) from the launcher. The first time anyone opens it, its workspace is created from the default described in Workspace reference.

3. Check your role: what you can see and do depends on it. See Roles and permissions.

4. Product administrators: work through Set up Vendor Risk Management (VRM) before your team starts.

5. Everyone else: start with Everyday tasks.

Where to go next

• Set up Vendor Risk Management (VRM)
• Everyday tasks
• Connect your systems
• Security, data and compliance
• Troubleshooting and the support guide
• Product overview on moraph.com