Third Party Ongoing Monitoring And Revie

# 24. Third-Party Ongoing Monitoring and Review

**Domain:** Third-Party Risk
**Level:** Practitioner

## Use Case

Conduct a structured periodic review of an existing supplier or third-party relationship. Covers performance against contractual obligations, risk profile changes, compliance status, and whether the relationship continues to meet the organisation's risk appetite. The operational third-party risk work that happens after onboarding - quarterly reviews, triggered reassessments, and annual due diligence renewals.

## Variables

| Variable | What to Enter | Example |
|----------|--------------|---------|
| `[SUPPLIER_NAME]` | Name of the supplier being reviewed | e.g. AWS, Salesforce, a specialist AI model provider, a managed security services provider |
| `[SERVICES_PROVIDED]` | What the supplier provides and what data or systems they access | e.g. Cloud hosting for core banking platform; processes customer PII; classified as critical supplier |
| `[REVIEW_TYPE]` | Type of review being conducted | e.g. Quarterly performance review, Annual due diligence renewal, Triggered review following an incident, Pre-contract renewal assessment |
| `[LAST_REVIEW_FINDINGS]` | What the last review found and what actions were agreed | e.g. Two medium risks identified: SLA breach in Q2, subprocessor not notified within required timeframe. Both marked as remediated. Or 'first review - no prior findings' |
| `[CHANGES_SINCE_LAST_REVIEW]` | Anything that has changed since the last review | e.g. Supplier acquired by a US company, supplier experienced a security incident affecting other clients, new AI features added to the platform, your organisation's data volumes with this supplier doubled |
| `[RISK_APPETITE]` | Your organisation's risk appetite for this supplier relationship | e.g. Critical supplier - zero tolerance for unresolved high risks; Standard supplier - high risks must be mitigated within 90 days; low criticality - medium risks acceptable |

## The Prompt

Copy everything below this line. Replace all `[VARIABLES]` with your specific information. Paste into Claude, GPT-4o, Gemini, or any capable LLM.

---