No vendor goes live without the evidence.
Every vendor moves through a governed lifecycle. Onboarding is blocked until the checklist passes, risk decisions are approved at the right level for the tier, and offboarding is confirmed by the Business Owner.
Owner notified by email · Due in 5 days · Full history retained for audit.
3 gaps identified; 2 map to existing risks, 1 proposed as a new finding. Approve or reject each before accepting.
Illustration with sample data
What Third-Party Lifecycle & Approvals does
Third parties move through Identified, Due Diligence or Risk Assessment, Pending Approval, Onboarding, Active, Under Review or Suspended, Offboarding, and Offboarded or Rejected. Only valid moves are allowed, and moves that matter need a reason. The onboarding gate blocks Active until there is an accepted assessment, evidence, no open Critical or High finding, a remediation plan, owners and an approved risk decision. Nothing moves a vendor to Active automatically.
Risk decisions follow a tier-based approval chain. By default, TPRM approves Low, a Business Owner joins for Medium, and an Executive or CISO for High and Critical, with segregation of duties: the proposer and the assessment reviewer can't approve. Accepting risk needs an expiry, and approval conditions become tasks. Monitoring events, such as intelligence, critical findings, tier increases, sub-processor changes and expired evidence, are reviewed by a person. The offboarding checklist checks automatically for open findings and risks.
Key capabilities
Governed lifecycle
Only valid status moves, with reasons and full history.
Onboarding gate
Active is blocked until the readiness checklist passes.
Tiered approvals
Approval chains by tier with segregation of duties, configurable per organisation.
Monitoring events
Material events become reviewable items, never automatic status changes.
Periodic review
Review intervals and finding-fix days by tier, with hourly reminders.
Offboarding checklist
Automatic checks plus Business Owner confirmation; records are kept.
The business case.
Efficiency, multi-framework alignment, reduced complexity and streamlined processes: what Third-Party Lifecycle & Approvals changes for your programme.
Vendors going live
The onboarding gate stops vendors becoming Active without evidence.
Approvals you can defend
Proposers and reviewers never approve their own decisions.
Less lifecycle admin
Gates, approvals, reminders and checklists replace tracking spreadsheets.
Depth by tier
Low-risk vendors move fast and critical ones get scrutiny.
Efficiency figures compare the effort of each workflow cycle in RiskVantis with the same work done manually or in a traditional GRC tool. Your result depends on your starting point; we will model it with you in a demo.
From setup to outcome.
Identify
Register the vendor and its tier.
Assess
Run due diligence and assessments.
Decide
Tier-based approval of the risk decision.
Monitor and offboard
Review events, reassess and offboard with a checklist.
Supports your obligations.
Third-Party Lifecycle & Approvals contributes evidence and coverage to these frameworks and regulations.
Common questions.
Can a vendor become Active automatically?
No. An approved decision moves a vendor only as far as Onboarding; a person moves it to Active once the gate passes.
Can we change the approval chain?
Yes. The third-party risk decision approval chain can be configured per organisation in the Workflow Designer, with simulation and approval before it takes effect.
Does monitoring change a vendor's status?
No. Monitoring raises reviewable events; reminders and sweeps never change a status.
Works better together.
Third-Party Register
Keep a complete inventory of third parties with owners, services, sub-processors and contract terms. A tier wizard sets assessment depth, an explainable score tracks…
Learn more →Third-Party Risk ManagementThird-Party Assessments
Send secure, no-login assessments that vendors can save and share question by question. Review each answer with AI assistance, and run reassessments that reuse earlier…
Learn more →Third-Party Risk ManagementVendor Due Diligence
Create a business opportunity, add the competing vendors and compare them across weighted sections, with clarifying Q&A, AI adequacy checks and a recorded, approved…
Learn more →See Third-Party Lifecycle & Approvals in action.
Book a 30-minute walkthrough tailored to your frameworks, vendors and team.