Third-party risk
Suppliers with an exact risk score, assessments by questionnaire through an expiring link, contract notice dates.
Records: suppliers, supplier assessments
Kibo / Kits / Third-party risk (TPRM)
Third-party risk, supplier by supplier.
Every supplier rated by how critical it is to you, its questionnaire and evidence reviewed, its next review never missed, and its contract safeguards on record.
Sample conversation
You
We want to start with PayFlow for payroll. They would process employee data, hosted in Ireland. Add them as a supplier, Lena Hoffmann owns the relationship.
Kibo
I will add PayFlow as proposed. Its risk score is worked out by the system from criticality and data sensitivity; it cannot become active before the security questionnaire and the sign-off.
PayFlow, payroll
SupplierPayFlowServicePayroll processingOwnerLena HoffmannCriticalityhighData processedpersonal data
1 · What it runs
The processes in this kit.
A supplier register with an exact risk score (criticality x data sensitivity x assessment age x open issues, explained for each supplier), supplier assessments by questionnaire through a private link that expires and can be revoked, the yes/no score written back to the supplier when they finish, and reminders before contract notice dates and assessments fall due. Suppliers only ever see their own questionnaire.
2 · Examples
Real requests, and the card each one produces.
Sample conversation
You
We want to start with PayFlow for payroll. They would process employee data, hosted in Ireland. Add them as a supplier, Lena Hoffmann owns the relationship.
Kibo
I will add PayFlow as proposed. Its risk score is worked out by the system from criticality and data sensitivity; it cannot become active before the security questionnaire and the sign-off.
PayFlow, payroll
SupplierPayFlowServicePayroll processingOwnerLena HoffmannCriticalityhighData processedpersonal data
Sample conversation
You
Send PayFlow our standard security questionnaire.
Kibo
I will create a private link tied to PayFlow, valid for 30 days, and nothing goes out before you confirm. When they finish, the score and gaps are written to the supplier and the risk is recomputed.
Security questionnaire for PayFlow
SupplierPayFlowQuestionnaireStandard security questionnaireSent on7 Nov 2026Link expires7 Dec 2026Statussent
3 · Approvals and reminders
Rules it sets up, enforced by code.
- Reminder · suppliers: 60 days before “notice date”
- Reminder · suppliers: 30 days before “next assessment”
- Report · A summary to the manager, the 1st of each month at 9:00