Map ICT providers, issue structured due-diligence questionnaires, collect supporting evidence and track supplier-risk actions without replacing your procurement or enterprise risk systems.
Use a structured workspace to organise responses, evidence, findings, owners and remediation actions. KPOData supports the process; regulatory and legal conclusions remain with the firm and its appointed advisers.
Supplier workflow
Evidence + approvals
DORA requires financial entities to manage ICT third-party risk as part of their overall ICT risk framework. The work involves more than maintaining a supplier list. Firms need to understand the services being provided, the functions they support, the applicable contracts, the associated risks and the evidence available for ongoing oversight.
KPOData can configure a supplier assessment portal around the firm’s methodology and approval process.
Provider and service inventory.
Questionnaires based on provider type and risk.
Evidence and certification requests.
Internal review and risk classification.
Findings, exceptions and remediation actions.
Periodic reassessment and evidence refresh.
Third-party assessments often require input from procurement, legal, risk, security, technology owners and the supplier itself. KPOData can divide the process into assigned sections and consolidate the responses into one reviewed assessment.
Supplier completes service and control questions.
Business owner confirms use and criticality.
Technology or security reviews control evidence.
Legal or procurement reviews contract information.
Risk and compliance approve findings and actions.
Many organisations already have procurement, contract or finance systems. The missing layer is often the configurable assessment and evidence workflow between those systems.
KPOData can focus on due diligence, evidence, approvals and remediation, with integrations or exports used where appropriate. This creates a narrower deployment than replacing the organisation’s complete supplier-management environment.
Import or reference existing supplier records.
Configure different questionnaires by risk or service.
Retain evidence against the provider and service.
Export findings and approved data.
Track follow-up actions after onboarding.
Illustrative workflow dashboard
Inventory
Questionnaires
Evidence
Findings
Actions
Reassessments
Active ICT providers
Open due-diligence reviews
Open supplier actions
Cloud hosting provider
High risk
Managed SOC service
Review
Payment processing provider
Approved
Backup supplier
Medium risk
Third-party risk changes as services, contracts, subcontracting and business dependencies change. The workflow can schedule reassessments, request updated evidence and alert owners when documents or approvals require review.
This helps move the process from a one-time questionnaire to a controlled oversight cycle.
Annual or risk-based reassessment schedules.
Evidence expiry and renewal reminders.
Contract and service change reviews.
Open-risk and overdue-action dashboards.
Historical comparison of responses.
The assessment may identify weaknesses in access controls, resilience, monitoring, backup, incident notification, data handling or exit planning. Those findings can create a separate technical remediation engagement while preserving a clear distinction between assessment support and specialist legal or regulatory advice.
The assessment may identify weaknesses in access controls, resilience, monitoring, backup, incident notification, data handling or exit planning.
Those findings can create a separate technical remediation engagement while preserving a clear distinction between assessment support and specialist legal or regulatory advice.
Central Bank guidance states that the register covers contractual arrangements for ICT services and is not limited only to providers supporting critical or important functions. Applicability and data treatment should be confirmed against current guidance.
Yes. Different question sets, evidence requirements and approval routes can be configured based on provider type, service or risk classification.
A role-based portal can be configured so external contributors see only the records and requests assigned to them.
The platform can collect, route and track contract information. Legal interpretation and contractual adequacy should be handled by appropriately qualified reviewers.
Yes. Reviews can be scheduled and updated evidence requested periodically or when a material change occurs.
Send us your existing ICT supplier questionnaire, evidence checklist or vendor-risk spreadsheet. We will map the data, contributors and approval flow required.
Your Business Growth Awaits