Services · Advisory
Find the gaps before the examiner does.
Independent assessment of your third-party risk program against the framework you're measured on — with ranked findings and a remediation plan your board can act on.
Who it's for
Programs facing an exam, an audit finding, or a new regulation
Pre-exam readiness
You have an OCC, FDIC, NYDFS or DORA review coming and want to find your own findings first.
Post-finding remediation
You have an MRA or audit finding on third-party risk and need a credible, dated plan.
New program or new regulation
You're building TPRM from scratch, or extending it to AI vendors, and want to build it right once.
What you get
Deliverables
| Deliverable | What it contains | Format |
|---|---|---|
| Gap assessment report | Control-by-control findings against your framework, severity-ranked, with evidence references | PDF + working file |
| Maturity score | Scored against the TPRA TPRM Maturity Model | Scorecard |
| Remediation plan | Owners, dates and effort for every finding, sequenced by risk | Tracker |
| Examiner briefing | One-page summary written for the regulator or audit committee | |
| Re-test | Verification of closed items and updated evidence pack | Report |
Frameworks
We assess against what you're measured on
Independence
Nobody is paying us for the answer
An assessment is a stranger telling you what is wrong with your program. The only reason to take that seriously is that the conclusion earns us nothing either way.
What that means in practice
- TPTH™ sells no software — no product, no white-label, no license resale.
- No referral fees, commissions or revenue share — from any platform, in any engagement.
- No vendor sponsorship — of the recommendation, the research behind it, or the report it appears in. We do seek sponsorship for the podcast, and any such contract covers the show alone and buys no influence over an engagement.
- You keep the working file. The scored findings, the maturity scoring and the remediation tracker are handed over in a form your team can re-run without us.
The same rule applies when the question is which platform to buy — see vendor-neutral tool selection →
Advisory in one page
Who it's for, the five deliverables, how an engagement runs, and the frameworks we assess against — for forwarding to whoever signs off the engagement.
The Evidence-First method
Four steps. The same practitioner from scope to hand-over.
Step 1
ScopeA 30-minute call, then a fixed-scope proposal. No paid discovery phase.Step 2
AssessDocument review, interviews and evidence testing against the framework you're examined under.Step 3
Close gapsRanked remediation with owners and dates, written for the board and the examiner.Step 4
Prove itRe-test, evidence pack and a hand-over your team can keep running.Questions
Before you book
How long does an assessment take?
Do we need to give you system access?
Can you work alongside our internal audit team?
What does it cost?
Related
Start free, or have us run it
Which of your vendors are critical?
The free eight-step vendor checklist: sort your vendors into systemically critical, critical or ordinary.
Get the checklist →Ready for the exam?
The free exam and audit readiness scorecard: eight questions to ask yourself before an examiner or auditor does.
Get the scorecard →Have us run it
Managed third-party threat hunting: practitioners on your systemically critical vendors, automation on the rest.
See the managed tiers →