TPRM Intelligence · Pilot programme
See your third-party risk clearly, with the evidence behind it
A structured supplier assessment and monitoring service for banks and financial institutions in Greece. The service is still taking shape, and we are opening a limited pilot programme to design it with the teams who would use it.
Why now
Institutions depend on a broad network of technology and cloud providers, fintechs, call centres and consultancies. Each relationship can bring ICT, operational, financial, privacy, concentration and reputational risk.
DORA
Regulation (EU) 2022/2554 has applied since 17 January 2025 and includes requirements on ICT third-party risk.
EBA guidance
Guidance and supervisory expectations on third-party risk management, including non-ICT services.
GDPR and the Bank of Greece
Data protection obligations, together with the relevant Bank of Greece requirements and supervisory expectations.
Whether each framework applies is assessed per institution, service and contract.
What it includes
Five capabilities covering the assessment, the fixes and what happens next.
Risk assessment
Inherent and residual risk, using a documented methodology.
Compliance review
Requirements mapped to controls, evidence and identified gaps.
Subcontractor mapping
Service dependencies and the relevant subcontracting chains.
Continuous monitoring
Agreed changes, incidents, evidence refreshes and remediation status.
Management reporting
Concise summaries for procurement, risk, compliance and technology.
The assessment report
Nine sections, with every finding pointing back to its evidence.
- 01
Executive risk summary
Overall view, material findings, key dependencies and recommended actions.
- 02
Vendor profile
Legal entity, ownership, service, financial information and public-domain checks.
- 03
Cybersecurity and ICT risk
Governance, controls, vulnerability management, incident response and assurance evidence.
- 04
DORA and ICT third-party review
Service classification, criticality, contract provisions, subcontracting, register data and exit planning.
- 05
Business continuity and resilience
Continuity, disaster recovery, testing, RTO and RPO.
- 06
Data protection and privacy
Processing roles, agreements, access, location, retention and safeguards.
- 07
Financial and operational risk
Financial resilience, dependencies, concentration and substitutability.
- 08
ESG and reputational risk
Policies, sanctions screening and adverse media, subject to lawful and proportionate checks.
- 09
Risk scoring and remediation
Findings, evidence references, severity, owners, target dates and follow-up.
How we score
- A high aggregate score never conceals a critical control failure.
- Mandatory escalation triggers, evidence-quality rules and risk appetite thresholds.
- Separate views of inherent and residual risk.
- Every score traces to evidence and the reviewer's rationale.
What it is not
- It is not a certification, and it does not automatically confirm compliance with DORA or any other framework.
- It does not transfer the institution's accountability for selecting and overseeing suppliers.
- Public sources alone do not replace supplier evidence or technical testing.
- Penetration testing, on-site audits and legal opinions are scoped and priced separately.
- Every assessment starts with a conflict-of-interest check and an independence statement.
The pilot programme
A small number of assessments, with a clear scope and authorised access.
- 01
Conversation
Your teams tell us what is missing today and which suppliers come first.
- 02
Agreed scope
We define the supplier, the service, the assessment boundary and access.
- 03
Assessment and report
We review the evidence and deliver a report with remediation priorities.
- 04
Calibration
Together we adjust the methodology, weights, effort and commercial model.
Risk visibility. Regulatory readiness. Better vendor decisions.