Course Introduction
Projects increasingly depend on external organizations to provide materials, specialist services, technology, engineering expertise, logistics, financing, and critical operational support. These relationships create opportunities to access specialized capabilities and improve delivery efficiency, but they also introduce risks that can affect cost, schedule, quality, compliance, security, and reputation. This course equips participants with practical methods for assessing, prioritizing, and managing third-party risks throughout the project lifecycle, enabling organizations to make informed sourcing decisions and maintain effective oversight of suppliers, contractors, consultants, subcontractors, and service providers.
Third-party risk extends beyond the possibility that a supplier may fail to deliver on time or within budget. External parties may introduce financial instability, inadequate technical capability, cybersecurity vulnerabilities, data protection concerns, regulatory breaches, unethical conduct, conflicts of interest, and weaknesses in their own supply chains. Participants will learn to identify these risk categories, evaluate their relevance to individual project requirements, and distinguish routine commercial exposure from risks that require enhanced due diligence or senior management attention. The course emphasizes a structured approach that considers both the likelihood of adverse events and their potential consequences for project objectives.
Effective third-party assessment begins before a contract is awarded and continues as the relationship develops. A supplier that initially meets technical and financial requirements may become less reliable because of ownership changes, deteriorating liquidity, labor disputes, geopolitical developments, capacity constraints, or dependence on vulnerable subcontractors. Participants will explore how to establish proportionate due diligence procedures, assess supplier suitability, verify relevant information, and identify warning indicators before commitments are made. They will also examine how assessment depth should reflect the criticality of the outsourced activity, the sensitivity of the information involved, the value of the contract, and the potential impact of service disruption.
The programme examines practical techniques for evaluating third-party risk across procurement, contracting, project execution, and closeout. Participants will learn to use risk questionnaires, evidence reviews, financial assessments, capability evaluations, site inspections, compliance checks, and structured scoring models to build a consistent picture of counterparty exposure. Particular attention is given to identifying critical dependencies, concentration risks, conflicts of interest, subcontracting arrangements, and weaknesses in business continuity. The course also explores how to translate assessment findings into appropriate contract protections, monitoring requirements, mitigation actions, contingency arrangements, and approval conditions.
Third-party risk management is most effective when responsibilities are clearly defined and information is regularly reviewed. Participants will examine how procurement, project management, legal, finance, compliance, information security, and operational teams can coordinate assessment activities without creating unnecessary duplication or administrative delays. They will learn to establish risk ownership, escalation thresholds, review schedules, performance indicators, and reporting mechanisms that keep decision-makers informed about changing exposures. The programme also addresses the importance of documenting assessment decisions, retaining supporting evidence, protecting confidential information, and applying consistent standards across suppliers and project locations.
By completing this course, participants will be better prepared to establish a risk-based third-party assessment framework that supports supplier selection, contract governance, ongoing monitoring, and effective exit planning. They will develop practical skills for identifying vulnerabilities, evaluating control effectiveness, prioritizing remediation, and responding to emerging concerns throughout the project lifecycle. Through realistic scenarios and applied assessment techniques, participants will strengthen procurement decisions, improve supply chain resilience, reduce avoidable disruption, and help protect project outcomes from risks arising beyond the organization's direct control.
Duration
5 days
Who Should Attend
-
Project managers responsible for evaluating external dependencies and managing supplier-related delivery risks.
-
Procurement and sourcing managers conducting supplier evaluations, due diligence, and tender assessments.
-
Project risk managers integrating third-party exposure into project risk registers and mitigation plans.
-
Contract managers responsible for commercial safeguards, supplier obligations, performance monitoring, and contractual remedies.
-
Supply chain managers assessing supplier capacity, subcontracting arrangements, logistics exposure, and continuity risks.
-
Vendor and supplier relationship managers overseeing external partner performance and risk remediation.
-
Enterprise risk professionals developing third-party risk policies, assessment standards, and governance frameworks.
-
Compliance officers evaluating regulatory exposure, ethical conduct, conflicts of interest, and counterparty compliance.
-
Finance professionals assessing supplier solvency, creditworthiness, payment exposure, and financial stability.
-
Information security and cybersecurity specialists assessing external technology providers and access to sensitive information.
-
Legal professionals reviewing contractual protections, liability allocation, due diligence findings, and termination provisions.
-
Quality assurance professionals verifying supplier capabilities, quality systems, certification status, and delivery standards.
-
Internal auditors and assurance professionals reviewing the effectiveness of third-party risk controls.
-
Business continuity and operational resilience specialists evaluating critical supplier dependencies and recovery arrangements.
-
Project sponsors, programme directors, and consultants overseeing complex sourcing strategies and external delivery partnerships.
Course Objectives
-
Explain the principles of third-party risk assessment and identify how external counterparties can affect project cost, schedule, quality, compliance, security, and reputation.
-
Develop risk-based due diligence procedures that evaluate supplier suitability, financial stability, technical capability, operational resilience, and ethical conduct before engagement.
-
Apply structured assessment criteria and scoring models to classify third parties according to criticality, exposure, inherent risk, and residual risk.
-
Evaluate supplier financial information, operational capacity, delivery history, ownership structures, and subcontracting arrangements to identify potential vulnerabilities.
-
Identify legal, regulatory, sanctions-related, cybersecurity, privacy, environmental, and reputational concerns relevant to third-party relationships.
-
Design practical assessment questionnaires, evidence requirements, verification procedures, and approval criteria that support consistent and defensible supplier decisions.
-
Integrate third-party risk findings into procurement evaluations, contract negotiations, project planning, contingency arrangements, and risk response strategies.
-
Establish monitoring indicators, reassessment triggers, escalation pathways, and reporting mechanisms to identify material changes in supplier risk exposure.
-
Develop mitigation and remediation plans that address identified control weaknesses, reduce critical dependencies, and strengthen third-party continuity arrangements.
-
Implement a coordinated third-party risk management framework with clear ownership, documented decisions, periodic reviews, and continuous improvement across the project lifecycle.
Comprehensive Course Outline
Module 1: Fundamentals of Project Third-Party Risk Management
-
Definitions and scope of third-party risk across suppliers, contractors, consultants, subcontractors, outsourced service providers, and strategic delivery partners.
-
Differences between third-party risk assessment, supplier qualification, procurement evaluation, contract management, and ongoing performance monitoring.
-
Examination of financial, operational, technical, legal, regulatory, cyber, environmental, ethical, and reputational risk categories affecting projects.
-
Principles of proportionality, accountability, evidence-based assessment, risk ownership, and lifecycle management in third-party governance.
Module 2: Third-Party Identification, Classification, and Risk Segmentation
-
Identification of external parties through procurement plans, contract registers, supplier databases, work packages, and project dependency mapping.
-
Classification of counterparties according to service criticality, contract value, access privileges, data sensitivity, substitutability, and potential disruption impact.
-
Differentiation between strategic suppliers, critical service providers, routine vendors, high-risk subcontractors, and other external dependencies.
-
Development of tiering criteria and assessment priorities to allocate due diligence resources according to materiality and exposure.
Module 3: Due Diligence and Counterparty Verification
-
Design of prequalification procedures covering legal identity, business registration, ownership, governance, relevant credentials, and declared conflicts of interest.
-
Evaluation of supplier financial health using available financial statements, liquidity indicators, credit information, and evidence of financial capacity.
-
Verification of technical competence, staffing capability, delivery history, quality certifications, equipment availability, and relevant project experience.
-
Review of appropriate compliance information, adverse indicators, sanctions requirements, and other screening considerations under applicable policies and laws.
Module 4: Third-Party Risk Assessment Methodologies
-
Development of structured assessment questionnaires, interview guides, evidence checklists, scoring criteria, and documented evaluation procedures.
-
Assessment of inherent risk before controls and residual risk after considering the design and effectiveness of relevant safeguards.
-
Application of probability, impact, exposure, criticality, and control maturity criteria to support consistent third-party risk ratings.
-
Calibration of scoring models, treatment of incomplete information, validation of assessor judgments, and documentation of uncertainty and limitations.
Module 5: Operational, Technical, and Supply Chain Risk
-
Evaluation of supplier production capacity, workforce availability, logistics arrangements, equipment reliability, and ability to meet project delivery commitments.
-
Identification of subcontracting dependencies, single-source exposure, geographic concentration, transportation vulnerabilities, and upstream supplier risks.
-
Assessment of technical compatibility, design interfaces, quality management systems, product traceability, and integration requirements.
-
Review of supplier continuity plans, recovery capabilities, alternative sourcing options, and contingency arrangements for critical goods and services.
Module 6: Financial, Legal, Compliance, and Reputational Risk
-
Analysis of counterparty financial deterioration, credit exposure, excessive leverage, payment difficulties, and warning signs of potential insolvency.
-
Assessment of contractual obligations, insurance coverage, liability provisions, performance security, warranties, and dispute resolution arrangements.
-
Identification of corruption risks, fraud indicators, conflicts of interest, labor concerns, environmental issues, and other relevant compliance exposures.
-
Evaluation of adverse publicity, litigation history, governance weaknesses, and reputational concerns using reliable and appropriately verified information.
Module 7: Cybersecurity, Data Protection, and Technology Third Parties
-
Assessment of third-party access to project systems, confidential information, personal data, infrastructure, and sensitive operational environments.
-
Review of cybersecurity controls, access management, incident notification, vulnerability handling, backup arrangements, and recovery procedures.
-
Evaluation of data handling practices, confidentiality obligations, data retention, cross-border transfers, and applicable privacy requirements.
-
Integration of technology risk findings into supplier approval decisions, contractual safeguards, ongoing security monitoring, and incident response arrangements.
Module 8: Contractual Risk Allocation and Mitigation Planning
-
Translation of assessment findings into contract requirements covering service levels, reporting, audit rights, security, compliance, and continuity obligations.
-
Evaluation of indemnities, liability limits, insurance provisions, guarantees, performance bonds, warranties, and termination rights in appropriate contexts.
-
Development of mitigation plans involving enhanced oversight, alternative suppliers, contingency stock, staged approvals, and additional control requirements.
-
Establishment of remediation actions, accountable owners, completion deadlines, evidence requirements, and approval conditions for unresolved risks.
Module 9: Ongoing Monitoring, Escalation, and Incident Response
-
Design of supplier monitoring processes using performance indicators, financial alerts, compliance updates, audit findings, and delivery trend analysis.
-
Definition of reassessment triggers involving ownership changes, financial deterioration, control failures, major incidents, and changes in service criticality.
-
Establishment of escalation procedures for missed milestones, contractual breaches, cybersecurity incidents, supplier distress, and unacceptable residual exposure.
-
Coordination of procurement, project management, legal, finance, compliance, and operational teams during third-party incidents and corrective action reviews.
Module 10: Third-Party Governance, Reporting, and Continuous Improvement
-
Development of third-party risk policies, role definitions, approval authorities, assessment standards, recordkeeping procedures, and governance reporting arrangements.
-
Integration of supplier assessments with procurement workflows, contract registers, project risk registers, vendor management systems, and assurance programmes.
-
Preparation of management dashboards showing risk ratings, critical dependencies, overdue remediation, reassessment status, and emerging exposure.
-
Evaluation of framework effectiveness through audit findings, supplier incidents, assessment quality reviews, lessons learned, and periodic process improvement.
Training Approach
This course will be delivered by our skilled trainers who have vast knowledge and experience as expert professionals in the fields. The course is taught in English and through a mix of theory, practical activities, group discussion and case studies. Course manuals and additional training materials will be provided to the participants upon completion of the training.
Tailor-Made Course
This course can also be tailor-made to meet organization requirement. For further inquiries, please contact us on: Email: training@upskilldevelopment.com Tel: +254 721 331 808
Training Venue
The training will be held at our Upskill Training Centre. We also offer training for a group (at a discount of 10% to 50%) at requested location all over the world. The Onsite course fee covers the course tuition, training materials, two break refreshments, buffet lunch, airport transfers, Upskill gift package, and guided tour.
Visa application, travel expenses, dinners, accommodation, insurance, and other personal expenses are catered by the participant
Certification
Participants will be issued with Upskill certificate upon completion of this course.
Airport Pickup and Accommodation
Airport pickup and accommodation is arranged upon request. For booking contact our Training Coordinator through Email: training@upskilldevelopment.com, +254 721 331 808
Terms of Payment:
Unless otherwise agreed between the two parties’ payment of the course fee should be done 3 working days before commencement of the training so as to enable us to prepare better.
