Third Party Risk Assessment Services
Know which suppliers put your organisation at risk, and what to do about it.
Most organisations rely on managed service providers, SaaS platforms and outsourced partners to run critical services. Each connection is a path into your systems and data, and regulators now expect you to show how you manage that risk, not just that you have a policy.
Many security teams know which suppliers need assessing but lack the capacity, so assessments get delayed, scoped down or reduced to a questionnaire nobody follows up. Avocado’s supplier risk assessment services close that gap. We independently assess your vendors, SaaS providers and service partners against recognised security control frameworks, and deliver clear risk ratings and an executive-ready remediation roadmap, typically within a week of the supplier responding.
You'll recognise the situation
You are onboarding a new SaaS platform, managed service provider or outsourced partner and need to understand the cyber risk before contracts are signed.
You are APRA-regulated and need to demonstrate structured oversight of material service providers under CPS 230, or address supply chain hazards in your CIRMP under the SOCI Act.
You have a backlog of unassessed suppliers and your team does not have the capacity to work through them with the rigour each one deserves.
You are going through a merger or acquisition and need a clear picture of the third party cyber risk your organisation is inheriting before the transition completes.
What's included
Supplier questionnaire and evidence review
Collection and review of supplier-provided evidence, including ISO 27001 certificates, SOC 2 Type II reports and penetration test results.
Security controls assessment and gap rating
In-depth review of each supplier's security controls, with a clear risk rating assigned to every gap identified.
Executive summary and recommendations report
Practical, prioritised findings delivered as an executive summary, followed by a consultant-led walkthrough with your team.
Optional extended due diligence
Expanding the assessment beyond cyber to include financial due diligence, service quality evaluation and contract review as required.
How it works
Scope
We agree which suppliers to assess, how they are tiered by risk, and the depth of assessment each tier requires.
Collect
We issue the questionnaire and request evidence from the supplier, including ISO 27001 certificates, SOC 2 Type II reports and penetration test results.
Assess
Our consultants review the supplier's controls, rate each identified gap, and recommend how to close it — typically within a week of the supplier responding.
Report and act
We walk your team through the findings, help you record residual risk, and agree on clear next steps for remediation and ongoing governance.
Find out where your supplier risk really sits
Talk to our team about your supplier backlog and how to clear it.
Structured evidence review plus independent control validation
We review each supplier's security controls against recognised frameworks, combining automated evidence analysis with consultants who have hands-on experience across ISO 27001, SOC 2 Type II, and penetration testing artefacts — validating real control effectiveness across every tier of your supplier register.
What you walk away with
Third party risk assessments for an ASX-listed global retailer
Delivered as burst capacity to clear a backlog quickly, or as an ongoing managed service at a fixed cost — either way, scoped to the suppliers and risk tiers that matter most to your organisation. Contact us for a tailored proposal and quote.
Common questions
What is third party risk management?
Third party risk management (TPRM) is how an organisation identifies, assesses and manages the risks that come from its suppliers, vendors and service providers. In cyber terms, it focuses on how those parties protect your data and the access they have to your systems.
How often should suppliers be assessed?
Assess medium and high risk suppliers at least annually and at every contract renewal. Low risk suppliers can be reviewed less often, or when their service scope or system access changes.
How does CPS 230 affect third party risk?
CPS 230 requires APRA-regulated entities to identify and manage the risks of relying on material service providers, keep a register of those arrangements, and have formal agreements in place. A structured assessment program gives you the evidence to demonstrate that oversight is working.
Is it cost-effective to outsource TPRM?
Yes, for most organisations. Outsourcing clears your backlog without adding permanent headcount, and frees your team to focus on strategy and remediation rather than chasing supplier evidence.
What do we receive at the end of an assessment?
A report for each supplier covering control effectiveness, a risk rating for every gap identified, and an executive summary with practical recommendations, followed by a walkthrough of findings with our consultants.
Find out where your supplier risk really sits
Talk to our team about your supplier backlog and how to clear it.