IS THIS FOR YOU?
A clear starting point
You need risk-based oversight of suppliers.
- Working arrangement
- Defined project scope; follow-up support agreed separately.
- What you bring
- Supplier inventory and relationship owners.
01 / THE BUSINESS CASE
Why this service matters
Suppliers may hold sensitive information or support critical services. Understanding those dependencies helps teams apply proportionate due diligence and follow up on important gaps.
02 / THE SERVICE
What is Third-Party & Supplier Risk?
Third-party risk management evaluates supplier relationships and their oversight needs. Assessment depth is matched to information access, criticality, and potential business impact.
WORKING TOGETHER
Our Approach
F&C leads the activities below with your process and system owners. Your team provides the agreed information, approves decisions, and owns ongoing operation unless separately scoped. Activities and outputs are confirmed in the proposal.
- 01
Classify supplier criticality.
Your team helps confirm the boundaries, priorities, and available information.
- 02
Request proportionate evidence.
We work with the relevant owners to review requirements and agree practical decisions.
- 03
Assess gaps.
Your team provides the agreed access, approvals, or operating evidence needed for delivery.
- 04
Agree follow-up actions and review dates.
We review the findings or agreed outputs together and clarify action ownership and follow-up.
What you will receive
The agreed outputs below give your team a record of the work and a basis for decisions and follow-up.
See scope and deliverables ↓DELIVERY AT A GLANCE
- 01
Classify supplier criticality.
- 02
Request proportionate evidence.
- 03
Assess gaps.
- 04
Agree follow-up actions and review dates.
YOUR SERVICE, IN FOCUS
Third-Party & Supplier Risk
Classify suppliers by risk and criticality
Review questionnaires and supporting evidence
Evaluate gaps and follow-up actions
03 / PRACTICAL SUPPORT
Key capabilities
- Classify suppliers by risk and criticality
- Review questionnaires and supporting evidence
- Evaluate gaps and follow-up actions
- Define lifecycle and review considerations
04 / YOUR DELIVERY PARTNER
Why F&C?
We connect risk decisions with practical operational action. You work with a team that understands the relationship between cybersecurity, business priorities, and sustainable implementation.
Business-led priorities
Your objectives, existing practices, and available capacity shape the scope.
Clear ownership
We agree responsibilities and evidence expectations with your team.
Premium expertise. Competitive pricing.
Our Philippines-based delivery model offers high-quality support with transparent, proportionate engagement scopes.
05 / WHAT YOU CAN EXPECT
Service scope & deliverables
We agree the boundaries, activities, and outputs before delivery. Depending on the engagement, the scope may include:
- Supplier risk classification method
- Assessment and evidence checklist
- Findings for suppliers in scope
- Remediation and review recommendations
Systems, locations, participants, tools, timelines, and any ongoing support are confirmed in the proposal. External certification, licensing, and third-party costs are included only when explicitly agreed.
07 / YOUR QUESTIONS
FAQs
No. A risk-based approach focuses attention on relationships with greater access, criticality, or impact.
Yes. The scope can include established relationships and new supplier onboarding.
The number of systems, locations, participants or suppliers, the quality of existing records, integrations, and any ongoing coverage shape the effort. We review these with you before proposing a timeline and price. You receive an agreed scope before work begins.