{"format":"epicdraw-workspace","version":1,"charts":[{"id":"template-third-party-risk-management-flowchart","name":"Third-party risk tiering pyramid","paper":"white","pattern":"blank","wobble":0.22,"ppm":48,"nodes":[{"id":"third-party-risk-management-flowchart-n1","type":"lane","text":"","x":0,"y":0,"w":1720,"h":1080,"fill":"none","fst":"solid","seed":701,"font":"sans","fs":22,"bold":false,"lv":0,"lock":true,"z":-20,"ink":"navy"},{"id":"third-party-risk-management-flowchart-n2","type":"text","text":"Third-party risk tiering pyramid","x":42,"y":24,"w":1620,"h":64,"fill":"none","fst":"solid","seed":702,"font":"hand","fs":48,"bold":true,"lv":0,"align":"left","ink":"navy"},{"id":"third-party-risk-management-flowchart-n3","type":"text","text":"Tier suppliers by how much harm they could do, then match the due diligence, contract terms and review frequency to each tier.","x":42,"y":96,"w":1620,"h":44,"fill":"none","fst":"solid","seed":703,"font":"sans","fs":23,"bold":false,"lv":0,"align":"left","ink":"grey"},{"id":"third-party-risk-management-flowchart-n4","type":"line","text":"","x":42,"y":160,"w":1636,"h":4,"fill":"none","fst":"solid","seed":704,"font":"sans","fs":22,"bold":false,"lv":0,"rot":0,"head":"none","ink":"navy"},{"id":"third-party-risk-management-flowchart-n5","type":"text","text":"EXAMPLE TEMPLATE · Replace the example content, owners and dates with your own.","x":42,"y":1032,"w":1630,"h":30,"fill":"none","fst":"solid","seed":705,"font":"sans","fs":18,"bold":false,"lv":0,"align":"left","ink":"grey"},{"id":"third-party-risk-management-flowchart-n6","type":"rect","text":"Tier 1 · Critical\n8 suppliers","x":307.5,"y":230,"w":175,"h":130,"fill":"softred","fst":"solid","seed":706,"font":"sans","fs":15,"bold":true,"lv":0},{"id":"third-party-risk-management-flowchart-n7","type":"rect","text":"Tier 2 · High\n34 suppliers","x":220,"y":366,"w":350,"h":130,"fill":"peach","fst":"solid","seed":707,"font":"sans","fs":17,"bold":true,"lv":0},{"id":"third-party-risk-management-flowchart-n8","type":"rect","text":"Tier 3 · Medium\n120 suppliers","x":132.5,"y":502,"w":525,"h":130,"fill":"sun","fst":"solid","seed":708,"font":"sans","fs":17,"bold":true,"lv":0},{"id":"third-party-risk-management-flowchart-n9","type":"rect","text":"Tier 4 · Low\n410 suppliers","x":45,"y":638,"w":700,"h":130,"fill":"leaf","fst":"solid","seed":709,"font":"sans","fs":17,"bold":true,"lv":0},{"id":"third-party-risk-management-flowchart-n10","type":"text","text":"Fewer suppliers, more scrutiny at the top","x":45,"y":785,"w":700,"h":30,"fill":"none","fst":"solid","seed":710,"font":"sans","fs":16,"bold":false,"lv":0,"align":"center","ink":"grey"},{"id":"third-party-risk-management-flowchart-n11","type":"rect","text":"T1","x":1100,"y":205,"w":137,"h":46,"fill":"softred","fst":"solid","seed":711,"font":"sans","fs":16,"bold":true,"lv":0},{"id":"third-party-risk-management-flowchart-n12","type":"rect","text":"T2","x":1243,"y":205,"w":137,"h":46,"fill":"peach","fst":"solid","seed":712,"font":"sans","fs":16,"bold":true,"lv":0},{"id":"third-party-risk-management-flowchart-n13","type":"rect","text":"T3","x":1386,"y":205,"w":137,"h":46,"fill":"sun","fst":"solid","seed":713,"font":"sans","fs":16,"bold":true,"lv":0},{"id":"third-party-risk-management-flowchart-n14","type":"rect","text":"T4","x":1529,"y":205,"w":137,"h":46,"fill":"leaf","fst":"solid","seed":714,"font":"sans","fs":16,"bold":true,"lv":0},{"id":"third-party-risk-management-flowchart-n15","type":"text","text":"Security questionnaire","x":790,"y":272,"w":295,"h":30,"fill":"none","fst":"solid","seed":715,"font":"sans","fs":16,"bold":false,"lv":0,"align":"right"},{"id":"third-party-risk-management-flowchart-n16","type":"rect","text":"●","x":1100,"y":260,"w":137,"h":52,"fill":"white","fst":"solid","seed":716,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n17","type":"rect","text":"●","x":1243,"y":260,"w":137,"h":52,"fill":"white","fst":"solid","seed":717,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n18","type":"rect","text":"◐","x":1386,"y":260,"w":137,"h":52,"fill":"white","fst":"solid","seed":718,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n19","type":"rect","text":"–","x":1529,"y":260,"w":137,"h":52,"fill":"white","fst":"solid","seed":719,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n20","type":"text","text":"SOC 2 or ISO 27001 report","x":790,"y":330,"w":295,"h":30,"fill":"none","fst":"solid","seed":720,"font":"sans","fs":16,"bold":false,"lv":0,"align":"right"},{"id":"third-party-risk-management-flowchart-n21","type":"rect","text":"●","x":1100,"y":318,"w":137,"h":52,"fill":"white","fst":"solid","seed":721,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n22","type":"rect","text":"●","x":1243,"y":318,"w":137,"h":52,"fill":"white","fst":"solid","seed":722,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n23","type":"rect","text":"◐","x":1386,"y":318,"w":137,"h":52,"fill":"white","fst":"solid","seed":723,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n24","type":"rect","text":"–","x":1529,"y":318,"w":137,"h":52,"fill":"white","fst":"solid","seed":724,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n25","type":"text","text":"Financial health check","x":790,"y":388,"w":295,"h":30,"fill":"none","fst":"solid","seed":725,"font":"sans","fs":16,"bold":false,"lv":0,"align":"right"},{"id":"third-party-risk-management-flowchart-n26","type":"rect","text":"●","x":1100,"y":376,"w":137,"h":52,"fill":"white","fst":"solid","seed":726,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n27","type":"rect","text":"●","x":1243,"y":376,"w":137,"h":52,"fill":"white","fst":"solid","seed":727,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n28","type":"rect","text":"◐","x":1386,"y":376,"w":137,"h":52,"fill":"white","fst":"solid","seed":728,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n29","type":"rect","text":"–","x":1529,"y":376,"w":137,"h":52,"fill":"white","fst":"solid","seed":729,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n30","type":"text","text":"On-site or remote audit","x":790,"y":446,"w":295,"h":30,"fill":"none","fst":"solid","seed":730,"font":"sans","fs":16,"bold":false,"lv":0,"align":"right"},{"id":"third-party-risk-management-flowchart-n31","type":"rect","text":"●","x":1100,"y":434,"w":137,"h":52,"fill":"white","fst":"solid","seed":731,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n32","type":"rect","text":"◐","x":1243,"y":434,"w":137,"h":52,"fill":"white","fst":"solid","seed":732,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n33","type":"rect","text":"–","x":1386,"y":434,"w":137,"h":52,"fill":"white","fst":"solid","seed":733,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n34","type":"rect","text":"–","x":1529,"y":434,"w":137,"h":52,"fill":"white","fst":"solid","seed":734,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n35","type":"text","text":"Data processing terms","x":790,"y":504,"w":295,"h":30,"fill":"none","fst":"solid","seed":735,"font":"sans","fs":16,"bold":false,"lv":0,"align":"right"},{"id":"third-party-risk-management-flowchart-n36","type":"rect","text":"●","x":1100,"y":492,"w":137,"h":52,"fill":"white","fst":"solid","seed":736,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n37","type":"rect","text":"●","x":1243,"y":492,"w":137,"h":52,"fill":"white","fst":"solid","seed":737,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n38","type":"rect","text":"●","x":1386,"y":492,"w":137,"h":52,"fill":"white","fst":"solid","seed":738,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n39","type":"rect","text":"◐","x":1529,"y":492,"w":137,"h":52,"fill":"white","fst":"solid","seed":739,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n40","type":"text","text":"Tested exit plan","x":790,"y":562,"w":295,"h":30,"fill":"none","fst":"solid","seed":740,"font":"sans","fs":16,"bold":false,"lv":0,"align":"right"},{"id":"third-party-risk-management-flowchart-n41","type":"rect","text":"●","x":1100,"y":550,"w":137,"h":52,"fill":"white","fst":"solid","seed":741,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n42","type":"rect","text":"◐","x":1243,"y":550,"w":137,"h":52,"fill":"white","fst":"solid","seed":742,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n43","type":"rect","text":"–","x":1386,"y":550,"w":137,"h":52,"fill":"white","fst":"solid","seed":743,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n44","type":"rect","text":"–","x":1529,"y":550,"w":137,"h":52,"fill":"white","fst":"solid","seed":744,"font":"sans","fs":22,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n45","type":"text","text":"Review every","x":790,"y":620,"w":295,"h":30,"fill":"none","fst":"solid","seed":745,"font":"sans","fs":16,"bold":false,"lv":0,"align":"right"},{"id":"third-party-risk-management-flowchart-n46","type":"rect","text":"6 m","x":1100,"y":608,"w":137,"h":52,"fill":"white","fst":"solid","seed":746,"font":"sans","fs":15,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n47","type":"rect","text":"12 m","x":1243,"y":608,"w":137,"h":52,"fill":"white","fst":"solid","seed":747,"font":"sans","fs":15,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n48","type":"rect","text":"24 m","x":1386,"y":608,"w":137,"h":52,"fill":"white","fst":"solid","seed":748,"font":"sans","fs":15,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n49","type":"rect","text":"Renewal","x":1529,"y":608,"w":137,"h":52,"fill":"white","fst":"solid","seed":749,"font":"sans","fs":15,"bold":false,"lv":0},{"id":"third-party-risk-management-flowchart-n50","type":"text","text":"● required","x":1100,"y":674,"w":180,"h":30,"fill":"none","fst":"solid","seed":750,"font":"sans","fs":15,"bold":false,"lv":0,"align":"left","ink":"grey"},{"id":"third-party-risk-management-flowchart-n51","type":"text","text":"◐ if relevant","x":1290,"y":674,"w":180,"h":30,"fill":"none","fst":"solid","seed":751,"font":"sans","fs":15,"bold":false,"lv":0,"align":"left","ink":"grey"},{"id":"third-party-risk-management-flowchart-n52","type":"text","text":"– not needed","x":1480,"y":674,"w":180,"h":30,"fill":"none","fst":"solid","seed":752,"font":"sans","fs":15,"bold":false,"lv":0,"align":"left","ink":"grey"},{"id":"third-party-risk-management-flowchart-n53","type":"todo","text":"Tiering questions","x":790,"y":760,"w":520,"h":234,"fill":"white","fst":"solid","seed":753,"font":"sans","fs":17,"bold":false,"lv":0,"items":[{"t":"Do they hold or access personal data?","d":false},{"t":"Would we stop trading without them?","d":false},{"t":"Annual spend over £250,000?","d":false},{"t":"Hard to replace within 3 months?","d":false}]},{"id":"third-party-risk-management-flowchart-n54","type":"lane","text":"","x":1340,"y":760,"w":335,"h":146,"fill":"none","fst":"solid","seed":754,"font":"sans","fs":22,"bold":false,"lv":0,"z":-1},{"id":"third-party-risk-management-flowchart-n55","type":"rect","text":"Rule","x":1340,"y":760,"w":335,"h":56,"fill":"mint","fst":"solid","seed":755,"font":"sans","fs":24,"bold":true,"lv":0},{"id":"third-party-risk-management-flowchart-n56","type":"text","text":"Two or more yes:\nTier 1 or 2.","x":1358,"y":830,"w":299,"h":64,"fill":"none","fst":"solid","seed":756,"font":"sans","fs":21,"bold":false,"lv":0,"align":"left"},{"id":"third-party-risk-management-flowchart-n57","type":"lane","text":"","x":45,"y":850,"w":700,"h":146,"fill":"none","fst":"solid","seed":757,"font":"sans","fs":22,"bold":false,"lv":0,"z":-1},{"id":"third-party-risk-management-flowchart-n58","type":"rect","text":"Re-tier when things change","x":45,"y":850,"w":700,"h":56,"fill":"sky","fst":"solid","seed":758,"font":"sans","fs":24,"bold":true,"lv":0},{"id":"third-party-risk-management-flowchart-n59","type":"text","text":"A new service, new data or a jump in spend\nmeans the supplier goes back through tiering.","x":63,"y":920,"w":664,"h":64,"fill":"none","fst":"solid","seed":759,"font":"sans","fs":21,"bold":false,"lv":0,"align":"left"}],"edges":[],"strokes":[],"imgs":{}}],"cur":"template-third-party-risk-management-flowchart"}