Choosing a TPRM platform: 10 questions to ask
The questions risk and procurement teams should put to any third party risk management vendor, why each one matters, and how Trestec answers it.
- 1
Does it give you one record for each supplier?
A list of vendors is not the same as knowing what each one does for you. Look for suppliers linked to services, contracts, assessments and evidence.
Trestec: Each supplier has one live record, linked to the services it supports and the contracts and assessments behind it.
- 2
Can it follow the rules that apply to you?
Ask how each requirement maps to evidence in the product, rather than whether the rule is mentioned on the website.
Trestec: PRA SS2/21, DORA and the EBA Outsourcing Guidelines are mapped to the evidence they ask for. Our website also explains ISO 27001 supplier controls.
- 3
How are materiality decisions made and recorded?
A score alone will not satisfy an auditor. You need to show who decided, when and why.
Trestec: Assessments use consistent criteria, and a named person's decision and reason are recorded.
- 4
How much work is due diligence for your suppliers?
If it is hard for suppliers, response rates and evidence quality fall.
Trestec: Suppliers answer and upload once through a secure portal, and question sets can be tailored to your organisation.
- 5
Can it see beyond your direct suppliers?
Many disruptions start with a provider you have no contract with.
Trestec: Subcontractors named in due diligence are added to the supplier map as fourth and further parties.
- 6
What does the AI do, and who stays accountable?
Ask whether AI suggests or decides, whether you can see its sources, and whether your data trains its models.
Trestec: AI produces suggestions with their reasoning and source. A named person accepts or overrides each one, and your data is not used to train AI models.
- 7
Can you produce evidence on demand?
Ask to see a real export and a real audit trail in the demo, not a slide.
Trestec: Decisions and changes are recorded as the work happens, and registers and reports can be exported. The DORA Register of Information exports in xBRL-CSV.
- 8
How is your data separated and protected?
Ask how one client is kept from another's data, where data is hosted, and for security documentation.
Trestec: Each client's data is kept separate and tested regularly, hosted in Europe, encrypted in transit and at rest. Access is by invitation with two-factor authentication. Single sign-on is not currently offered.
- 9
How long until it is useful?
Ask who does the data migration, and what you will have at the end of the first month.
Trestec: We agree with you at the start how your existing data comes in, and the plan for the first month.
- 10
Is it built for your size of team?
Enterprise suites can need dedicated administrators. Simple tools can run out of depth as regulation grows.
Trestec: Trestec is built for risk and procurement teams to run themselves, with tenant administrators managing their own team.
How to run the comparison
List your must-haves from your regulations and your biggest gaps
Ask each vendor the same questions, and see the answers in the product
Test with your own suppliers and one real contract before you decide
Put these questions to us
A 30 minute walkthrough built around your suppliers. No obligation, and an honest answer on fit.