[OR] [Pillar] [E4] [C5] TPRM Tools, Templates and Scoring Models

eBook 4: Chapter 5

TPRM Tools, Templates and Scoring Models

Introduction

A robust Third-Party Risk Management (TPRM) framework must be supported by practical tools, structured templates, and consistent scoring models. Without these, organisations struggle to operationalise governance, assess risks consistently, and demonstrate compliance with regulatory expectations.

Regulators such as the Bangko Sentral ng Pilipinas (BSP) and Bank Negara Malaysia (BNM) expect financial institutions to adopt a risk-based, evidence-driven approach to managing third-party risks. This requires standardised templates for vendor inventory, risk assessments, monitoring, and reporting—supported by quantitative scoring models.

This chapter provides Excel-ready templates and scoring methodologies that participants can directly apply in their organisations.

Purpose of This Chapter

By the end of this chapter, readers will:

• Use standardised TPRM templates
• Apply risk scoring models for vendor classification
• Build dashboards and heatmaps for reporting
• Align tools with Operational Resilience and CBS requirements

Section 1: Core TPRM Templates (Excel-Ready)

1.1 Third-Party Inventory Register

Purpose

Maintain a centralised repository of all third-party relationships.

Template

👉 Excel Tip:

• Use dropdown lists for Criticality (High/Medium/Low)
• Apply filters for CBS and Vendor Owner

1.2 Vendor Risk Assessment Template

Purpose

Assess inherent and residual risks across key domains.

Template

👉 Excel Formula:

• Weighted Score = Score × Weight
• Total Risk Score = SUM(Weighted Scores)

1.3 Vendor Criticality Assessment

Purpose

Determine the importance of the vendor to CBS.

Template

👉 Classification:

• 20–25 = Critical
• 15–19 = High
• 10–14 = Medium
• <10 = Low

1.4 Vendor Monitoring Dashboard

Purpose

Track ongoing performance and risk indicators.

Template

👉 Excel Tip:

• Use conditional formatting:
• Green = On target
• Amber = Slight deviation
• Red = Breach

1.5 Incident & Issue Log

Purpose

Track third-party incidents affecting CBS.

Template

1.6 Exit Management Checklist

Purpose

Ensure smooth vendor transition.

Template

Section 2: Risk Scoring Models

2.1 Inherent Risk Scoring Model

Scoring Scale

2.2 Residual Risk Calculation

Formula:

Residual Risk = Inherent Risk × (1 – Control Effectiveness %)

Example:

2.3 Risk Rating Classification

2.4 Vendor Risk Heatmap

Template (Excel Matrix)

👉 Excel Tip:

Use color gradients:

• Red = Critical
• Orange = High
• Yellow = Medium
• Green = Low

Section 3: TPRM Dashboard (Executive Reporting)

3.1 Sample Dashboard Metrics

3.2 Dashboard Layout (Excel)

👉 Excel Tip:

• Use pivot tables
• Add charts (bar, pie, trend lines)

Section 4: Integration with Operational Resilience

Mapping Templates to OR Components

Section 5: Implementation Roadmap

Step-by-Step Deployment

Key Takeaways

• Standardised templates ensure consistency and auditability
• Scoring models enable objective risk classification
• Dashboards provide real-time visibility for decision-making
• Tools must align with CBS and Operational Resilience frameworks
• Excel-based models are practical and scalable for implementation

The effective management of third-party risk depends not only on frameworks and governance but also on the practical tools used to implement them.

By adopting structured templates and quantitative scoring models, organisations can transform TPRM from a theoretical concept into a measurable, actionable discipline.

These Excel-ready tools provide a foundation for consistent risk assessment, proactive monitoring, and informed decision-making—ensuring alignment with regulatory expectations, including BSP Circular No. 1203 and BNM Operational Resilience guidelines.

When integrated with Operational Resilience, these tools empower organisations to maintain the continuity of critical business services, even in the face of third-party disruptions.

C1	C2	C3	C4
C5	C6	C7	C8

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.