TPRA Process

Purpose

To assess and manage third-party risk before onboarding new suppliers and for existing suppliers, ensuring compliance with data protection, information security, financial and regulatory requirements. The TPRA process provides assurance that third parties handling DMG data or systems meet required risk and compliance standards before contracts are signed or renewed.

Full process documentation: Third-Party Risk Assessment Process (Confluence).

Participants

• Business Owner / Requester
• Database / Data Team
• InfoSec / Technology
• Legal / Compliance
• Finance (where applicable)
• Vendor Assessment Review Board

Input

• TPRA request raised via Jira Service Desk
• Supplier details and services description
• OneTrust New Supplier Survey responses
• Automatically triggered questionnaires based on supplier services: Information Risk Assessment Questionnaire (IRAQ), ROPA, Privacy Impact Assessment (PIA) where required

Output

• Approved or Rejected TPRA decision
• Any required risk mitigations or conditions
• Confirmation issued to the Business Owner via Jira
• Supplier approved to proceed to contract signing (outside TPRA scope)
• Assessment records stored in OneTrust

Responsibilities

Receives final TPRA outcome and proceeds with contract signing where approved.

• Onboards suppliers in OneTrust
• Launches and manages supplier questionnaires
• Performs data protection and privacy analysis
• Determines whether ROPA or PIA is required

• Reviews information security, system access and technical risk
• Assesses results of the Information Risk Assessment Questionnaire (IRAQ)

• Reviews data protection and legal compliance responses
• Confirms regulatory obligations are met

Reviews financial risk where applicable (based on services provided).

• Reviews completed assessments
• Approves, rejects or requests further information