Third-party risk
beyond the questionnaire

What the questionnaire misses

Most third-party risk programmes rest on a self-assessment questionnaire, a credit score and a sanctions screen. All three are worth having, and all three are answered by the third party or by an algorithm. None of them tells you that the supplier lost its two best engineers last quarter, that other customers are quietly dual-sourcing, that the distributor's principal is in a dispute with a former partner, or that the subcontractor two tiers down is the one that actually makes the part.

That information exists. It sits with the third party's other customers, its former employees, its competitors and the people who service its industry. Theory finds those people, verifies who they are, and asks.

What we assess

Financial fragility: whether the third party can survive a lost customer, a price shock or a delayed payment, judged from filings, credit behaviour and what its own suppliers and customers say. Operational dependence: how much of your process runs through it, what its own dependencies are, and what its real capacity and recovery position look like. Reputational and integrity exposure: the record of the company and its principals in litigation, enforcement, sanctions and press, and what counterparties say about how it behaves under pressure. Regulatory exposure: whether its practices, ownership or locations create obligations or restrictions for you. Concentration: how many of your critical inputs converge on the same few companies, sites or jurisdictions.

Deliverables

For one third party, a Signal Brief: record checks, six to eight verified interviews with people who have dealt with the company, a signed two-page assessment and a provenance appendix. For a critical supplier or partner, or a tier of a supply chain, a Decision Study: fifteen to thirty interviews, a full written assessment ranked by exposure, recommended controls and alternatives, and a working session with procurement, risk or the deal team. For the handful of third parties your business cannot run without, an Intelligence Retainer keeps them under watch and reports monthly.

Who commissions this

Procurement and supply chain leaders before a sole-source award or a long contract. Risk and compliance functions that need more than a screen for a high-exposure relationship. Investors doing due diligence on a target whose value depends on a few suppliers or channel partners. Companies entering a new country through a local distributor or agent, where the work overlaps with geopolitical risk.

All work is delivered under The Theory Standard. See services and prices.