Skip to content

Moraph for clients

Sign in

Reference

Vendor Risk Management (VRM) glossary

Terms used in Vendor Risk Management (VRM) and its documentation.

Applies to Vendor Risk Management (VRM) as it works today. Moraph updates the platform continuously, and this page is reviewed when it changes.

Last reviewed 1 min readReport a problem

Terms used in Vendor Risk Management (VRM) and its documentation.

TermMeaning
Inherent riskThe risk a relationship poses before any controls, based on data access, criticality and customer impact.
Risk tierThe category set from inherent risk that decides due diligence and review frequency.
Critical activityA service whose failure would significantly affect your institution or its customers, requiring heightened oversight.
SOC reportAn independent auditor's report on a service organization's controls.
Complementary user-entity controlA control that a vendor's SOC report expects your institution to operate.
Relationship ownerThe person who manages a vendor day to day and records the conclusion of each review.
Secure upload linkA link that lets a vendor contact upload requested documents without an account.
Fourth partyA subcontractor of your vendor, recorded as the vendor lists it.
Risk acceptanceA recorded decision to accept an issue's risk instead of remediating it.

Was this page helpful?

Report a problem with this page
What’s the problem?
Quote the step or heading if you can. Don’t include passwords or personal records.
Only if you’d like a reply. We use it for this report and nothing else.

Need help with your own setup rather than this page? Raise a support ticket.