For an EU regulated buyer, the right third-party risk management (TPRM) platform is the one that produces evidence a supervisor will accept — on demand, from the source, with the verification level attached. This guide sets out the evaluation criteria that actually decide that choice, the questions to ask every vendor, and how to test the answers before you sign.
Choose a third-party risk management platform on seven criteria, weighted in roughly this order for a regulated EU buyer:
A platform that is strong on the first two and the last — provenance, regulatory fit, and audit-readiness — is the one that stands up when a competent authority asks for your Register of Information. Everything else is a feature list.
For each criterion: what to ask the vendor, why it decides defensibility, and how to confirm the answer in a trial rather than a demo.
Ask: Do you verify company data live against source registries, and which ones? Why: under DORA Article 28 and the EBA guidelines a supervisor asks for evidence, not assertions — self-declaration and aggregator data are weaker than a fact pulled from the source. Test: run a supplier whose registry record you can check independently and confirm the platform resolves it live, with a timestamp, rather than echoing what you typed.
Ask: Is DORA Article 28 and my national EBA variant native, or a module? Why: a platform built around a generic framework cannot produce the Article 28 Register of Information or the national-variant evidence on short notice. Test: ask to see the Register of Information export and the mapping to your authority (CBI, BaFin, DNB, ACPR or CSSF) in the trial.
Ask: Where is the company registered, where is the data hosted, who are the sub-processors, and can I export and delete my data? Why: supplier assessments are regulated records, and a non-EU operator may fall under extraterritorial data-access regimes. Test: request the sub-processor list, the GDPR DPA, and the EU data-residency attestation before you load real suppliers.
Ask: Is every dimension of the score explainable with its underlying source data? Why: a black-box risk number is not defensible at review and cannot be challenged or corrected. Test: open a scored supplier and confirm you can trace each dimension to the evidence and the verification level behind it.
Ask: How does evidence age — do you apply staleness decay and re-verify on a cadence? Why: DORA requires ongoing monitoring, not an annual questionnaire; stale evidence is a finding waiting to happen. Test: ask how a certificate that expires, or a registry record that changes, is reflected in the score and when.
Ask: What is your published pricing, and how long from sign-up to a first scored assessment? Why: months-long deployments and opaque quotes delay the evidence you are obligated to hold. Test: sign up and reach a scored assessment yourself; if that is not possible without a sales process, factor the delay into the decision.
Ask: Can you produce a supervisor-ready report on demand, and may I read a sample? Why: the only output that matters at review is the artefact you hand the authority. Test: export the report and read it as an auditor would — every score should carry its source, its verification level, and a date.
Take these to any TPRM vendor demo. The answers separate a defensible platform from a questionnaire tool with a dashboard.
We designed FiorLab around the same seven criteria, because they are the ones that decide whether an assessment survives a supervisory review.
You do not have to take that on faith — the point of the criteria above is that you can test every one of them yourself.
Run a real supplier through all seven criteria in minutes. Free Starter, no sales process, no card required.