Trestec vs spreadsheets for third party risk
Spreadsheets are where most supplier risk programmes start. This is what changes when the list becomes a live record, and when a spreadsheet is still enough.
Side by side
The same job, done two ways.
Supplier record
A row per supplier, often in several versions.
One live record per supplier, linked to its services, contracts, assessments and subcontractors.
Materiality decisions
A column with a value. The reasoning usually sits elsewhere.
Consistent assessments, with a named decision owner and a recorded reason.
Due diligence
Questionnaires by email, chased and tracked by hand.
Suppliers answer and upload through a secure portal, and reminders and chasers run in the system.
Contract review
Someone reads each contract and notes the terms.
The contract analyser extracts key terms and flags missing or weak clauses, linked to the source text, for your team to review.
Subcontractors
Rarely recorded, and hard to compare across suppliers.
Subcontractors named in due diligence appear on the supplier map, showing where suppliers rely on the same provider.
Audit trail
Version history at best. Hard to show who decided what, and why.
Decisions, assessments and changes are recorded with who made them and when.
Regulatory registers
Built by hand from several files, then checked by hand.
Registers come from the same record. The DORA Register of Information has a readiness check and exports in xBRL-CSV.
Access control
Anyone with the file can usually see all of it.
Role based permissions per organisation, with two-factor authentication.
Signs you have outgrown the spreadsheet
- Nobody is sure which version of the supplier list is current
- Due diligence is tracked in one person's inbox
- Preparing for an audit or board meeting means days of chasing
- You cannot quickly say which services depend on a given supplier
- You do not know which suppliers share the same subcontractor
- A regulator expects a register you currently assemble by hand
When a spreadsheet is still enough
- You have a small number of suppliers and none is critical to your services
- No regulator or customer asks you to evidence your supplier oversight
- One person owns the list and keeps it current
If that describes you, keep the spreadsheet for now. Not sure? The maturity check takes about two minutes.
Common questions
See your supplier list as a live record
A 30 minute walkthrough built around your suppliers. No obligation, and an honest answer on fit.