Third-party risk under DORA and NIS2, demonstrably documented.
A supplier register with tiering, a dependency graph down to subcontractors and a Register of Information export that refuses a half-empty file. Built and hosted in the EU.
From now to next
From supplier list to a demonstrable view of the chain
Every organisation has a list of suppliers. Showing how deeply those suppliers are embedded in your own processes, and substantiating that to the supervisor, is another matter.
Nobody oversees the chain
When a supplier fails, only then does it become clear which business functions and subcontractors depend on it.
Dependency graph
Business functions, suppliers and their subcontractors in one graph, with concentration risk marked on the node itself. In the outage test you choose a party, a type of service or a country and see what stops working.
The register is never finished
The Register of Information is assembled in a spreadsheet at the last minute, with gaps nobody notices.
Export with a pre-check
The export (DORA art. 28(3)) refuses a register with missing mandatory fields, says which ones, and takes you with one click to the place where you fill them in.
Assurance sits in a folder
Supplier ISAE and SOC reports are requested but not assessed in a structured way, and the supplier sends them by e-mail.
Assurance in the same environment
The supplier uploads its report through a personal link, without an account. You assess type, period, opinion, CUECs and subservice organisations, and a report that no longer covers stands out in the cockpit.
The contract renews itself
The notice period sits in a PDF nobody opens, and the contract rolls over before anyone has reassessed the supplier.
Notice alerts per contract
Every contract is an object of its own with term and notice period. Thirty days before the notice date the contract owner is alerted. If nobody has responded fourteen days after the notice date, the alert goes to the administrators of your organisation.
This is what it looks like
A selection from TPRM
Click a thumbnail for that screen, or the image itself for the full-size view.
Frequently asked questions
What you want to know about TPRM up front
What is TPRM?
TPRM (third-party risk management) is Audirium's supplier register for third-party risk under DORA and the NIS2 supply chain duty of care. It combines a register with tiering, a dependency graph down to subcontractors, contracts with requirement lists, assessment of assurance reports, a notification simulator and the Register of Information export in one environment.
Who is TPRM for?
For risk officers, compliance and audit functions and procurement at financial institutions under DORA and at organisations with a supply chain duty of care under NIS2. It is built for those who must be able to show the supervisor which suppliers the organisation depends on and how they are controlled.
What does TPRM do in practice?
TPRM records suppliers with a reasoned tier, draws the chain from business function to subcontractor, tracks per contract the term, notice period and requirements of DORA, NIS2, CRA and ISO 27001, lets suppliers upload their assurance report through a link, calculates reporting deadlines for an incident and exports the Register of Information with a pre-check.
How is TPRM different from a spreadsheet or a supplier list in a procurement system?
A spreadsheet does not know which business functions depend on a supplier or which subcontractor three suppliers share; the graph shows that. The Register of Information export refuses an incomplete register and says which fields are missing. A CUEC from an assurance report can be linked to the contract requirement that rests on it.
How does TPRM use AI, and who decides?
The AI reads an assurance report in targeted sections and marks per contract requirement whether it appears in the contract, each time with a quote and page reference and with a note on which sections were not found. Every field is a proposal you check before it is saved. Whether the scope fits, the period aligns and which residual risk you accept is never filled in by the AI.
How are data and hosting handled in TPRM?
Data is stored separately per organisation on Hetzner servers in the European Union. Reports and contracts you upload sit next to your own organisation's database. A supplier who uploads through the personal link only sees the single request that link belongs to.
What TPRM offers
One environment for the whole chain
TPRM brings register, graph, contracts, assurance and notification duties together, so you answer the supervisor from one place.
AI reads, you conclude
The AI reads a hundred-page assurance report in targeted sections and marks per contract requirement whether it appears in the contract, with a verbatim quote and page reference. Only those sections go to the AI model your organisation has configured; your administrator chooses the route, including processing within the EU, or switches AI off. Every field is a proposal you check; the conclusion on scope, period and residual risk is never filled in by the AI.
Tiering with a rationale
Every supplier gets a tier from 1 (critical) to 4 (low). You choose the framework per supplier: DORA, NIS2 or both; tier 1 is then called critical or essential. The risk triage records the factors (critical function, data access, replaceability) and derives a tier proposal from them; you may deviate.
Dependency graph and map
From business function via supplier to subcontractor, so concentration risk becomes visible. A globe shows how many suppliers sit in each country and where the concentration lies.
Register of Information
Export in line with DORA art. 28(3), with a gate that stops an incomplete register and, for every missing field, a button to the place where you fill it in. The LEI code is checked against its check digits.
Contracts and requirements per framework
A supplier can have several contracts, each with term, notice period, document versions and a clause check. Requirement lists for DORA (15 provisions), NIS2, CRA and ISO 27001, to check off per contract with a quote as evidence.
Supplier link without an account
When requesting a report you create a personal link that you send yourself. The supplier uploads the report and answers five questions; the answer sits as a draft with your request until you accept or reject it.
CUECs linked to your own requirements
The controls you must operate yourself for the service auditor's opinion to hold are tracked with an owner and a status. For each CUEC you pick the contract requirement it belongs to, so you see which requirement rests on your own control.
Notification simulator and live file
Calculates the NIS2, DORA and GDPR reporting deadlines for an incident at a supplier, with that supplier's contractual notification term alongside. A file tracks during the incident what has been reported and what is still open.
A cockpit that counts fairly
One score for the chain, weighted over eight sub-measures. A measure that does not apply to you does not count as zero, an empty register never shows green, and a missed reporting deadline turns the light red regardless of the average.
How it works
From supplier to accountability in six steps
Record the suppliers
Register suppliers with service, country and owner. The risk triage derives a tier proposal that you accept or adjust with a rationale.
Map the chain
Link business functions, suppliers and subcontractors in the dependency graph and see where the concentration risk sits.
Record contracts and test the requirements
Add each supplier's contracts with term and notice period, upload the document and let the AI propose a quote per requirement. You confirm before anything lands in the checklist.
Request assurance and assess it
Send the supplier a personal link for the report. Assess type, period, opinion, the controls you must implement yourself (CUECs) and the parts that fall outside the report. If the report period does not align with your financial year, the app calculates the size of the gap for which you need a bridge letter.
Rehearse the notification duty
Use the simulator to see which deadlines start when a supplier fails, and record a real incident as a file with reportable items to tick off.
Report to the supervisor
Export the Register of Information once the pre-check is green, and read in the cockpit who is up and what expires within sixty days.
Within the suite
What TPRM reads from the other tools, and what it gives back
TPRM only reads from the registers of other tools and never writes into them. A source that cannot be reached is called exactly that, never 'no data'.
Privorium
A supplier shows the GDPR status from the processor register: is there a processor agreement, are transfers safeguarded, are the sub-processors known. In return, Privorium shows the supplier's tier on an agreement.
BCM
The supplier card shows which business processes rely on this supplier and which recovery time the impact analysis demands of it, next to the recovery time in its SLA.
NIS2 Scanner
The register provides the evidence for the supply chain theme in the NIS2 Scanner, so you do not answer that question twice. TPRM in turn reads your own NIS2 position from the Scanner.
Incident and Asset
A notification file can be attached to an ICT incident in the Incident app, and a contract to an asset in the asset register, with the provenance of that data shown alongside.
Know who is in your chain, and be able to prove it?
Request a demo or get in touch for more information about TPRM for your organisation.