Tiering decides how much due diligence each vendor gets. Get it wrong and you either over-assess the stationery supplier or under-assess the cloud provider.
| Driver | Lower risk | Higher risk |
|---|---|---|
| Data access | None or public | Personal, financial or confidential data |
| System access | None | Privileged, remote or on-site access |
| Criticality | Easily replaced | Supports a critical business service |
| Volume | Few records | Millions of records |
| Location | In your jurisdiction | Offshore or unclear |
| Sub-contracting | None | Many fourth parties |
Weight each driver, sum to a score and map ranges to four tiers. Then apply floors: material outsourcing is always Tier 1; vendors processing personal data are never below Tier 2; privileged access to sensitive data is Tier 1. Record the drivers and floors so the tier is explainable.
After the assessment, rate control strength — strong, adequate or weak. Residual risk is read from a matrix of inherent tier against control strength, and should not drop below high while a critical issue is open.
| Inherent tier | Strong controls | Adequate | Weak |
|---|---|---|---|
| Tier 1 | Medium | High | Critical |
| Tier 2 | Low | Medium | High |
| Tier 3 | Low | Low | Medium |
| Tier 4 | Low | Low | Low |
Analysts sometimes know more than the model. Allow overrides, but require a written reason and approval by a second person, and keep the original score visible.
A payroll provider processes salary and identity data for all employees through a cloud platform. Data access is sensitive, volume is high and the service is critical: the inherent tier is 1. The assessment shows strong access controls but an untested continuity plan, so control strength is adequate and residual risk is high until the continuity test is completed and evidenced.
Tiers drift as relationships change: a vendor that started with a pilot may now process all customer data. Re-run the intake at every reassessment, at contract renewal and whenever the scope of service changes, and let any material change trigger a new tiering decision with the same approval rules as the first.
NAZZTEC AI TPRM automates this end to end — with AI assistance, segregation of duties, analytics and signed reports — and is available as SaaS, in your private cloud or on-premises, hosted in the Kingdom. Our consultants design and run the process alongside it through our Governance, Risk & Compliance services.
Next step: request a demo of NAZZTEC AI TPRM or read more on the product page.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
Spreadsheets and e-mailed questionnaires cannot keep up with hundreds of vendors. Here is what AI-driven TPRM software must deliver — and where human judgement must stay in charge.
A 300-question spreadsheet sent to every supplier produces fatigue, not assurance. Design questionnaires by tier, ask for evidence, and review answers consistently.
Every asset passes through the same stages. Control each transition and the register stays accurate without annual clean-ups.
Tell us what you are working on. A senior NAZZTEC consultant will come back within one business day with a practical view.
We respond to every enquiry within one business day.