Your vendors' vendors, assessed.
Map each vendor's services and sub-processors at every level, see the group's real risk, and extend an assessment to the fourth parties that matter, without duplicates and with the parent's approval gated on them.
Payments depends on 2 vendors; single point of failure for Checkout and Refunds.
Illustration with sample data
What Sub-processors & Assessment Cascade does
Sub-processors are recorded with relationship type, purpose, data, locations and contract reference. Linking one to its own register entry places it in the vendor hierarchy and lets it be assessed. The Register Tree shows services, multi-level sub-processors and assessments, and cycles are prevented. Own and group figures are calculated once: group risk is the highest material risk, never an average, completion is weighted by required questions, and posture is the worst in the group.
When you assess a vendor you can extend the scope to its sub-processors. Each one is assessed new, linked to an existing assessment, or excluded with a rationale, either for direct sub-processors only or at every level. Sub-assessments are ordinary assessments with their own links and contacts. Parent approval is blocked by unaccepted mandatory sub-assessments or an open Critical sub-finding, unless an allowed override rationale is given.
Key capabilities
Services & sub-processors
Multi-level fourth parties with purpose, data and locations.
Register Tree
Services → sub-processors → assessments, with cycles prevented.
Own vs group metrics
Highest risk, weighted completion and worst posture for the group.
Assessment cascade
Assess, link or exclude each sub-processor, at one level or all.
No duplicates
Idempotent creation and versioned scope amendments.
Gated parent approval
Blocked by open mandatory sub-assessments or critical sub-findings.
The business case.
Efficiency, multi-framework alignment, reduced complexity and streamlined processes: what Sub-processors & Assessment Cascade changes for your programme.
No hidden dependencies
See and assess the sub-processors that handle your data.
Sub-processor oversight
Evidence that processors' sub-processors were assessed.
Less cascade coordination
One-step cascade creation replaces manual chasing of sub-assessments.
Never averaged away
The riskiest member defines group risk.
Efficiency figures compare the effort of each workflow cycle in RiskVantis with the same work done manually or in a traditional GRC tool. Your result depends on your starting point; we will model it with you in a demo.
From setup to outcome.
Map
Record services and sub-processors and link them to the register.
Scope
Choose which sub-processors to assess, link or exclude.
Cascade
Sub-assessments are created once, with their own contacts.
Approve
The parent decision waits for the sub-assessments that matter.
Supports your obligations.
Sub-processors & Assessment Cascade contributes evidence and coverage to these frameworks and regulations.
Common questions.
Can a parent vendor see its sub-processor's answers?
No. Child assessments are separate, with their own links and contacts.
How is group risk calculated?
As the highest material risk among the vendor and its descendants, never an average.
What if a sub-processor isn't in the register?
It can be recorded, but it must be linked to its own register entry before it can be assessed.
Works better together.
Risk Visualizer & Point of Failure
See where one vendor or provider failure would take down critical operations, including concentration, systemic dependencies and fourth parties shared by several of your…
Learn more →Third-Party Risk ManagementThird-Party Assessments
Send secure, no-login assessments that vendors can save and share question by question. Review each answer with AI assistance, and run reassessments that reuse earlier…
Learn more →Third-Party Risk ManagementThird-Party Register
Keep a complete inventory of third parties with owners, services, sub-processors and contract terms. A tier wizard sets assessment depth, an explainable score tracks…
Learn more →See Sub-processors & Assessment Cascade in action.
Book a 30-minute walkthrough tailored to your frameworks, vendors and team.