Vendor Diligence and Management

Third-party risk management (TPRM) and vendor due diligence

Third-party risk management (TPRM) is the process of monitoring, validating, and remediating risks presented by third-party vendors. TPRM helps ensure your vendors protect your data, comply with regulations, and provide sustainable services that meet your requirements. However, vendor risk management can be a costly and time-consuming task. Our vendor management outsourcing service (VMOS) allows your company to offload the vendor due diligence and risk assessment process. Unlike other vendor risk management solutions and vendor management software providers, ACA's VMOS will help your company save valuable time and resources in order to focus on more strategic tasks.

CONNECT WITH US


CONNECT WITH US


Our solutions

Vendor Due Diligence

Our team administers due diligence questionnaires (DDQs), ensures vendors reply in a timely manner, and provides vendor support.

 

Analysis

Our team analyzes DDQ responses, evidence, and audits to identify vendor risks.

 

Reporting

You can track vendor diligence progress and view findings in our vendor risk management software platform.

Additional Advisory Services
  • On-site validation
  • On-site vendor due diligence
  • TPRM program development
  • Vendor risk ranking

 

GDPR Vendor Diligence

We can help determine if your vendors are compliant with GDPR requirements, working towards compliance, or have not considered the implications of GDPR. Our vendor management outsourcing service platform includes a GDPR-specific due diligence questionnaire that can be administered as a standalone questionnaire at a reduced rate, or as part of the standard ACA Aponix vendor DDQ.

1 of
Solution Spotlight

Our Vendor Management Software

Our vendor management software allows you to track DDQ progress and vendor risk assessment results. Key features include:

  • Vendor Risk Dashboard — View key metrics (e.g., vendors diligenced, progress of diligence reviews, and vendor comments)
  • Vendor Registry — View vendor data in centralized location (e.g., product lines, type of diligence performed, and contracts)
  • Vendor Risk Matrix — View all risks identified (e.g., ratings, issues), vendor communication, and mitigation/remediation activities
  • Questionnaire Status — Track the completion status of vendor DDQs and on-site reports

Why work with us?

Dedicated Team Of InfoSec Risk Analysts

Our vendor risk assessments are developed and managed by a team of information security risk analysts in ACA’s centralized, cost-effective analysis and review center (the ARC) in Pittsburgh, PA. The ARC’s dedicated vendor management outsourcing service team is overseen by an experienced vendor risk specialist and includes former senior managers in risk management, insider threat specialists, and data security officers from various industries, including financial services, banking, and healthcare. Over 750 clients and 2,000 vendors have chosen ACA to manage their vendor management process and mitigate third party risks.  
 

Our Vendor Risk Assessments

Our tailored, proprietary vendor due diligence questionnaires (DDQ) include over 300 questions and are customized for each vendor type to provide an accurate assessment of possible risks. Topics include:

  • General Data Protection Regulation (GDPR) compliance
  • Cyber awareness training
  • Governance
  • Physical and environmental security
  • Network security, infrastructure, and operations
  • Organizational overview and structure
  • Financials
  • Legal and compliance
  • Vendor management and oversight
  • Change management
  • Cloud services
  • Access controls
  • Mobile device management
  • Resiliency
  • Asset management
  • Data loss prevention

Why ACA?

Clients

750+

Vendors diligenced

2,500+

Latest Insights

curved glass building looking up at a blue sky

UK Buy Side Should Prepare for More FCA Market Abuse Scrutiny

The UK’s Financial Conduct Authority (FCA) is increasing its focus on market abuse at buy-side firms with new publications, activities and potential enforcement actions, according to panellists at a

Compliance Alert
  • Compliance
highway at night from overhead

Employee Data Governance Policies: Minimizing Impact, Maximizing Value

Regulatory mandates and pressure from investors are driving firms to implement new security policies which can be challenging for employees. Here's a set of key guidelines to minimize the impact and maximize the value of implementations for your employees.

Article
  • RegTech
highway at night from overhead

How RegTech Helps Compliance Teams Increase Efficiency and Reduce Risk

Although regulatory compliance will always be a function led and directed by people, technology can support those efforts and make processes more efficient and effective. Here are five ways it can be of benefit to your firm to make RegTech an everyday part of your compliance program.

Article
  • RegTech
highway at night from overhead

Year-End Compliance Checklist for CCOs

With the holiday season here and year-end looming, the pressure is mounting to cross those final compliance to-do’s off the list and finish the year strong. We’ve developed the following checklist to help guide you through the key areas to consider as you head into 2019.

Article
  • Compliance
highway at night from overhead

Do You Have Sufficient Resources? Ensure Compliance Coverage for the Holiday Season and Beyond

The year-end brings with it regulation changes and increased demands that last throughout the first quarter of the year. It’s all too easy for many compliance tasks to take a back seat due to lack of staff and bandwidth. Compliance officers and managers need the assurance that they can start 2019 off on the right foot and still have the resources available to fulfill both their regulatory obligations and their fiduciary duty to clients on a daily basis.

Article
  • Compliance
highway at night from overhead

Brexit: The Impact on Your Marketing and Distribution Activities

With four months to go until the United Kingdom’s anticipated exit of the European Union, the world braces itself for the final ‘divorce’ arrangements to be agreed, and to understand the subsequent consequences of those decisions. With questions still unanswered on how Brexit will impact investment firms, we examine possible marketing and distribution issues post-Brexit.

Article
  • Compliance

News

ACA Group Named a 2024 DataTech50 Provider

ACA Group acknowledged as one of the most innovative tech companies offering data management solutions in financial services

ACA Group Expands U.S. Compliance Team with Former SEC and FINRA Regulators, In-House CCOs, Seasoned Regulatory Consultants, and Attorneys

We are committed to meeting the needs of our clients. This year, we have made several notable additions to the team to help us to continue to operate at the forefront of the compliance industry. Learn more about our team.

ACA Group Acquires Encore Compliance Adding AI Technology to Enhance Managed Services Capabilities

ACA Group Acquires Encore Compliance to Enhance Managed Services Capabilities with AI Technology. Acquisition enhances ACA’s technology solutions to support day-to-day compliance requirements and reduce risk

Upcoming events