August 2026

September 2026

October 2026

November 2026

3rdRisk Roadmap

To keep labels consistent across the platform, tags will move into Configuration and extend to documents. Today tags can only be created while editing a record, so the same idea ends up spelled three different ways and nobody can tidy it up afterwards.Key Enhancements<ul><li>one page for every tag: a single list in Configuration showing all tags, filtered by where they are used: third parties, contracts, controls, issues, risk register and frameworks.</li><li>create without a record: add a new tag directly, without opening a record first.</li><li>safe renaming: rename a tag and every record carrying it follows, so nothing loses its label.</li><li>archiving with a guard: archive tags you have finished with. A tag still in use cannot be archived, and you are told how many records are holding it.</li><li>nothing deleted outright: archived tags stop appearing in pickers and filters, but are never removed.</li><li>permission controlled: access to tag management is governed by its own permission.</li><li>tags on documents: tag a document as you upload it or later, with as many tags as it needs.</li><li>document filtering: tags appear in document lists and can be filtered on, useful where the list of document types has grown unwieldy, since a tag carries your own terminology without adding another type.</li></ul>This update will cut duplicate and inconsistent tags, give administrators one place to tidy up safely, and make documents easier to find without expanding the list of document types.

In Progress

Tag Management

Kamilla Dajani

To make risk beyond your direct suppliers visible, the catalogue will show supply chain relationships as a hierarchy and AI will propose the suppliers your third parties are likely to depend on. Today the catalogue lists the companies you contract with but says much less about who they in turn depend on, so risk sitting one step further out stays invisible until something breaks.Key Enhancements<ul><li>hierarchy in the catalogue: direct suppliers are listed on their own, each showing how many sub-suppliers sit beneath it.</li><li>expandable rows: expand a supplier to see its sub-suppliers nested underneath, rather than flattened into one long list.</li><li>shared suppliers shown in each place: a supplier serving more than one of your third parties appears under each of them.</li><li>AI-proposed suppliers: AI suggests the suppliers your third parties are likely to depend on, giving a reason and a source for each.</li><li>contained until reviewed: proposals arrive in the catalogue marked Identified and stay out of assessment recipients, dropdowns and every other list until you decide on them.</li><li>accept or dismiss: accept a proposal and it becomes a third party you can monitor, taking its stakeholders from the supplier above it. Dismiss it and it disappears.</li></ul>Requires AI enabled for your tenant.This update will extend visibility one tier beyond your direct suppliers, and turn tier mapping from a manual research task into a review of what AI has already found.

AI-Powered Tier Discovery

Documents that need signing have to leave 3rdRisk: you download the PDF, send it from somewhere else, then upload the signed copy and hope the record stays tidy. This closes that loop.Key Enhancements<ul><li>send from the document: choose "Sign with DocuSign" from a PDF's action menu and add your signers by name and email, as many as the document needs.</li><li>no new permissions: available to anyone who can already edit the document.</li><li>status you can see: the document shows where the request stands and where each signer stands.</li><li>kept informed: an email as each person signs and another when the last one is done, both editable in Content → Communication like any other notification.</li><li>signed copy comes back: the completed document is fetched and stored against the record automatically, with no manual upload.</li><li>quick setup: an administrator connects your DocuSign account on the Integrations page.</li></ul>

DocuSign Integration

To give one clear answer to how risky a supplier is, a single Overall Risk score will be calculated from the risk signals already held on a third party. Today that risk sits across several separate columns — predictive risk, risk domains, sanctions and PEP, country, assessments — and none of them answers the question. Overall risk cannot be sorted or reported on, because it does not exist as a number.Key Enhancements<ul><li>one overall score: an Overall Risk score, badge and level on every third party, in the catalogue and wherever badges appear.</li><li>columns that read in order: Overall Risk first, then Inherent Risk, Assessment, Sanctions, Country and Status.</li><li>breakdown on hover: Inherent Risk shows the predictive score and each domain, Sanctions shows sanctions and PEP separately, and Assessment shows each finished assessment as a point on a timeline.</li><li>honest empty state: where nothing has been scored yet, the third party reads as insufficient data rather than as low risk.</li><li>a Risk Weights page: a new page in Configuration with one section per component, so the whole model is visible on one screen.</li><li>weights you control: set how much Inherent Risk, Assessment, Sanctions and Country each contribute. By default Inherent Risk carries all the weight and the rest carry none, so nothing changes until you decide it should.</li><li>weighting within components: split Inherent Risk between the predictive profile and your risk domains, then across individual domains. A new domain starts at zero until you give it weight.</li><li>your own thresholds: set the boundaries between Low, Medium, High and Critical yourself.</li><li>validation before saving: weights must total 100 per cent, and the page will not save until they do.</li><li>always current: the score recalculates whenever an underlying score or a weight changes.</li></ul>The manual Risk Profile field on a third party is removed. Overall Risk is calculated from your data and your weights, so it can no longer be set by hand.This update will give one sortable, reportable measure of third-party risk, and let each customer decide what that measure is made of.

Completed

Overall Risk Profile

Contract oversight does not scale. Review procedures are retyped per contract, renewal deadlines surface too late to act on, and a contract can only be opened in a modal with no single view of it.Key Enhancements<ul><li>warnings while you can still act: notifications before a contract's notice deadline or end date, by email and in the platform, to the contract manager and business owner. The expiry window is configurable and defaults to 90 days.</li><li>contract duration types: mark a contract as indefinite, fixed-term with tacit renewal, or fixed-term without. Contracts that renew tacitly have their end date extended automatically; contracts that expire become inactive when the date passes. Both are recorded in the audit log.</li><li>notice periods on every contract: a notice period in days, optional, no longer limited to DORA contracts. The renew or exit reminder now fires ahead of the notice period rather than the end date, and the contract timeline shows time until notice separately from notice until end.</li><li>reusable review templates: a library of review procedures in Configuration, usable on contracts and third parties. Each review gets a title and a criticality, reviews can be removed, and editing a template can push the change to reviews already open.</li><li>a contract cockpit: a page per contract showing its master data alongside its notes, documents, issues, risks, assessments, reviews, subcontractors, internal controls, related contracts and security posture, with a timeline of the whole contract.</li><li>contract-level assessment contacts: an optional email per contract, automatically copied in when you send an assessment for that contract.</li></ul>

Contract Management

To let organisations express risk in their own terms, risk domains will become configurable per domain rather than fixed by the platform. Today every domain uses the same four level names and the same four colours, drawn from the platform instead of the customer's own risk taxonomy. In addition, the lowest score an answer can carry is 1, so no answer can take a domain out of scope and suppliers end up scored on domains that do not apply to them.Key Enhancements<ul><li>per-domain level naming: Low, Medium, High and Critical can be renamed to an organisation's own terminology, independently for each risk domain.</li><li>configurable colours: each level's colour is set from a colour picker and applied wherever that domain's score appears, including PDF reports and exports.</li><li>translatable names: level names are held per language, so each language carries its own wording, with uniqueness checked per language within a domain.</li><li>independent domains: two domains can label the same level differently, and editing one never affects another. Existing domains keep current names and colours until edited, and nothing is applied until saved.</li><li>calculation safety: renaming or recolouring a level never alters a score or a risk calculation.</li><li>expanded answer scoring: answer scores become a searchable list running from Not applicable through 0 to 100, replacing a free number field with a minimum of 1.</li><li>zero scoring: an answer scored 0 keeps its question in the calculation and contributes nothing to the total.</li><li>not applicable scoping: an answer marked Not applicable removes its question from the calculation entirely, so a single answer, such as confirming a supplier processes no personal data, can take a whole domain out of scope for that supplier.</li><li>clear empty state: a domain with nothing left to score shows greyed out in the catalogue rather than as a low score.</li><li>unchanged for assessors: answers are still chosen by their wording, with changes confined to configuration.</li></ul>This update will let each customer align risk domains with their own taxonomy and language, and stop suppliers being scored against domains that do not apply to them.

Risk domains configuration

To widen what the platform watches and cut down how much users have to read, news monitoring will cover countries and industries as well as individual suppliers, with AI summaries and closer links to daily work. Today news arrives one supplier at a time in a pop-up, a large supplier can produce items hourly, and risk tied to a country or a sector is not watched at all.Key Enhancements<ul><li>country risk map: a world map on the Ecosystem page, each country coloured by its risk level. Click a country to see its risk profile and recent news.</li><li>industry view: a list of each sector with its risk level, how many of your third parties sit in it, its latest news, and how many different sources reported it.</li><li>act on a country or sector: raise a risk or an issue for a whole country or sector, or send an assessment to every third party in an industry in one go.</li><li>daily summaries: a summary of the past 24 hours of news for a third party, written overnight so it is ready when you open the record. You can ask for a new one, and countries get the same summary.</li><li>dashboard overview: one widget showing the whole news picture.</li><li>news on the record: news moves out of its pop-up and onto the third party itself, with its column nearer the front of the catalogue.</li><li>issues from news: create an issue from a news item with type, deadline, location and criticality already filled in, or link the item to an issue you already have.</li><li>tags and filters: tag news items and filter by tag, both in the news list and in the catalogue.</li><li>notes on news: keep notes against a news item, with the author and date saved.</li><li>news behind an issue: see the news that led to an issue from the issue itself.</li><li>two sources, one list: news from RID shown alongside your existing Business Radar feed.</li></ul>Country and industry views need AI enabled.This update will show risk tied to countries and sectors that is invisible today, reduce how much news each person reads, and keep news, decisions and follow-up on the same record.

Planned

Ecosystem News Monitoring

To cut down repeated manual editing, bulk actions will expand from starting assessments and generating risk profiles to updating fields across many records at once. Today you can act on a selection in a few ways, but any actual edit is made one record at a time.Key Enhancements<ul><li>bulk field updates: available on third parties, contracts, ecosystem assessments and controls. Select the records, choose Update fields, and set the new values once.</li><li>stepped flow: confirm the records you picked, choose which fields to change, then enter the values. Records can be added or removed inside the flow, so a mis-click on the overview does not send you back to the start.</li><li>sensible field list: only fields that make sense across several records are offered. Names, addresses, contact details and financial values stay per record. Your custom fields are included.</li><li>checked before writing: values are validated before anything is saved, so a mistake changes nothing.</li><li>runs in the background: work happens in batches so you can carry on, and you are told in the platform and by email when it finishes.</li><li>failures you can retry: if some records fail you are told how many, and can reopen the flow with only those.</li><li>full audit trail: every record changed is written to the audit log exactly as a single edit would be.</li><li>LEI lookup for DORA: find and fill LEI numbers for DORA third parties, looked up by name and filled only where the registered name matches.</li><li>more bulk actions: archive internal control assessments, cancel or archive external form submissions, create a default contract for third parties without one, and invite users from a spreadsheet rather than one at a time.</li></ul>Permission to update is checked for each record, not once for the whole selection.This update will remove hours of repeated editing for teams managing large portfolios, and make routine changes safe to apply at scale.

Mass Operations

Finding data means building filters on each page. This lets you connect an AI assistant instead, and ask it directly.Key Enhancements<ul><li>connect your own assistant: link a tool such as Claude Desktop or ChatGPT to 3rdRisk, authorising it once through a consent screen.</li><li>read and update your records: list, open, create and update third parties, issues, action plans and framework sections. Risks, contracts and assessments follow.</li><li>your permissions apply: every request runs through the same permission checks, validation and access restrictions as the interface. Nothing is deleted through this route.</li><li>the same filters you already use: each list can be narrowed by the same filters as its page in the platform.</li><li>explicit access: a connection has to be granted permission to use this specifically, so an ordinary token cannot reach it.</li></ul>

Connect Your AI Assistant to 3rdRisk

Recurring assessments made third parties re-enter answers they had already given, and reviewers were fixed on the questionnaire rather than the assessment. These changes shorten the questionnaire for suppliers and give your team more control over each round.Key Enhancements<ul><li>build and edit in the platform: create questionnaires from Content → Questionnaires in the interface rather than through Excel.</li><li>autofill on re-assessment: where a third party has completed the same questionnaire before, they are prompted per questionnaire to fill in their previous answers and review them. Answers only, not comments or attachments.</li><li>optional questions: define whether a question must be answered or can be skipped. </li><li>conditional questions: a question can stay hidden until an earlier one is answered a particular way. Hidden questions are cleared, skipped in scoring and left out of exports.</li><li>a copy for the third party: on finishing, they can download their answers as a PDF or have it emailed, organised by questionnaire, domain, question, answer, comments and attachment, and styled to your branding. Emailed copies are password-protected.</li><li>document types per question: a question accepts only the document types you allow.</li><li>reviewers per assessment: assign the reviewer on the assessment rather than the questionnaire, changeable while in flight but not removable once they have taken review actions.</li><li>a reason when reverting: sending an assessment back from verification to review prompts an optional comment, shown to the reviewer and recorded in the audit log.</li><li>cancelled assessments stay readable: open a cancelled assessment read-only, the same as a finished one.</li><li>schedule the next round as you finish: set an optional next-assessment date at finalisation, editable or removable afterwards.</li></ul>

Ecosystem Assessment Improvements

To make lists behave predictably wherever a user happens to be working, sorting and filtering will be standardised across every module in the platform. Today each list carries its own subset of sortable columns and its own incomplete filter set, so knowledge gained on one page does not transfer to the next and finding records depends on which page you are on.Key Enhancements<ul><li>full column sorting: every column where sorting is meaningful becomes sortable ascending and descending, across third parties, contracts, ecosystem assessments, questionnaires, schedules, risks, frameworks, controls, issues, action plans and control assessments.</li><li>custom field filtering: custom fields can be marked as filterable and then used to narrow third party and contract lists on empty, not empty, or matching values, with multiple conditions combined.</li><li>complete filter sets: filters missing today are added per module, including treatment, contract, risk officer, reporter and specific measures on the risk register, framework section, manager and risk officer on frameworks, and frequency, tags and scheduled items on the schedule page.</li><li>presence filters: quick checks for records that have action plans, issues, controls or measures, so coverage gaps are visible without opening records.</li><li>aligned internal control filters: one consistent set across the controls page, all four assessment stages and the dashboard, including correction of two filters that are currently mislabelled or broken.</li><li>case-insensitive matching: filter searches return the same results regardless of capitalisation, so "erp" finds "ERP".</li></ul>This update will reduce the time users spend locating records, make list behaviour predictable from one module to the next, and remove a source of silently incorrect exports.

Sorting & Filtering Consistency

To enhance engagement and compliance, gamification elements will be introduced in third-party risk management (TPRM) and internal control processes. This will encourage user participation, improve adherence to risk policies, and create a more interactive experience.<h4 style="text-align: start">Key Enhancements</h4><ul><li>achievement tracking: users earn badges or points for completing assessments, mitigating risks, or improving control effectiveness.</li><li>leaderboards &amp; progress indicators: visibility into team and individual performance to drive engagement.</li><li>streaks &amp; rewards: incentives for maintaining consistent compliance and timely risk management actions.</li><li>interactive challenges: scenario-based quizzes or simulated risk events to reinforce best practices.</li></ul>This update will increase user motivation, improve risk awareness, and drive more proactive risk and control management

Value Intelligence Framework - Gamification

Working out whether something matters means correlating a supplier's assessment history, recent news, sanction status and contract state by hand, across several screens. And when one event affects many suppliers, it arrives as many separate alerts rather than one piece of information.Key Enhancements<ul><li>the platform notices on its own: it reviews a third party or a country when something changes, such as a news item, a completed assessment, a sanction hit, a tier change or a contract update, and also sweeps overnight for patterns that only appear when looking at everything at once.</li><li>one insight instead of many alerts: when a single event affects a group of your suppliers, you get one finding covering the group, telling you how many are affected and which ones, rather than a separate alert per supplier.</li><li>every finding shows its working: open any finding to see what the AI was asked, which of your records and sources it consulted, and what it concluded at each step.</li><li>evidence you can follow: findings cite the news items, sanction reports, assessments and contracts they rest on.</li><li>you decide what happens next: acknowledge, dismiss or comment on a finding. The history is kept and cannot be altered afterwards.</li><li>shaped by your priorities: the AI works from your own settings, including the countries that matter to you, the regulations you follow and your industry focus, using the same prompt configuration as the rest of the platform's AI.</li></ul>Sits behind the AI setting, off until you turn it on.

AI findings across your portfolio

Working in the catalogue takes more clicks than it should, duplicates get created, and there is no way to produce a shareable summary of a third party's risk.Key Enhancements<ul><li>click a name to open it: clicking a name or title opens that record directly, across the catalogue, contracts, issues, action plans, risks, controls and assessments. A third-party name opens its cockpit. The ID still opens messages and the audit log.</li><li>third-party risk report: generate a report for one third party, viewable on screen and downloadable as a PDF, covering its risk profile by component with a short summary of each.</li><li>ecosystem risk report: select any number of third parties and produce one portfolio report covering overall risk, the highest-risk third parties, hotspots by domain, sector and geography, data gaps and recommended next steps.</li><li>duplicate warning when adding: a matching VAT, DUNS, KvK or internal reference blocks the save and names the existing record. A matching name and country shows a warning without blocking.</li><li>update existing records on bulk import: the import checks and matches the file first, then shows you what will change so you can accept or skip each match. Only values that differ are written, blanks never clear a field, and every update is logged.</li><li>link a risk without leaving the catalogue: search existing risks or create a new one on the spot, the same way linking an issue already works.</li><li>next review date column: see and sort by when each third party is next due for review, without opening each record.</li></ul>

Third-party Catalogue

Any user could see any third party, regardless of whether it was their responsibility. Access can now be limited per third party, and will become more granular.Key Enhancements<ul><li>access per third party: a user only sees the third parties they have access to. Restricted ones do not appear in searches, dropdowns, reports or dashboards, cannot be linked to assessments, issues or action plans, and are refused if reached by direct link.</li><li>access per risk domain: restrict access to individual risk domains within a third party, so a team responsible for one domain cannot edit another team's, on the same third party.</li><li>start with no access: add a user to specific third parties only, so they see nothing by default. The existing model, where access to everything is narrowed down per third party, stays available.</li><li>a cleaner permission list: role management shows only the permissions for modules and features active on your environment. Nothing is removed, and roles keep permissions that are hidden.</li></ul>