Third-party risk management
Onboard vendors faster.
Automate intake, evidence collection, risk assessments, issues management, reporting, and ongoing monitoring, so you complete due diligence end to end without the back and forth.
What you get
Third-Party Risk Management, in detail.
Reviews with real stages
Initial, periodic, inventory refresh, offboarding, and service amendment reviews move through inherent risk, requirements, evidence collection, evidence review, and reporting. Rename the types to match your program.
Inherent risk assessment
Score a vendor or a single service from questionnaire answers. Risk and criticality drive which evidence packet gets sent and how deep the review goes.
Evidence packets and document requests
Configurable packets with conditional logic, owners, due dates, and overdue reminders. Standard request packets can be preset by risk level so analysts never start from a blank list.
AI-graded requirements, with citations
Kobalt reads SOC reports, contracts, certificates of insurance, DPAs, and policies, then grades each requirement against the evidence using your own control-strength labels. Every result points at the source text.
Issues, follow ups, and key dates
Non-compliant checks open issues automatically. Follow ups run as a thread with the vendor. Contract renewals, SOC bridge letters, and review deadlines get reminders.
Reports in your template
Upload your existing Word report. Kobalt fills it from the review data and negative news, and exports DOCX or PDF. Document health and risk assessments export too.
Fourth-party risk
Record the subcontractors each vendor depends on — including companies that aren't your own vendors — so a critical fourth party is on the map, and keep that exposure under watch as part of ongoing monitoring.
Continuous monitoring
Keep watching after the review closes: adverse media and negative news digests and document expiry tracking, so a vendor that drifts does not go unnoticed.
Workflow
How a review runs.
- 01
Intake
Add vendors by hand, through a public intake form the AI triages against your existing inventory, or straight from procurement.
- 02
Collect
Vendors answer packets and upload documents in a dedicated portal, branded as you. Reminders chase what is late.
- 03
Review
AI extracts terms and grades every requirement. Analysts accept, override, or ask the vendor for more, and each decision is logged.
- 04
Report and monitor
Generate the report, record residual risk and status, and keep watching with negative news monitoring and document expiry tracking.
Outputs
What leaves the system.
Everything exports in a form your auditors, board, and vendors already use.
- Filled review reports (DOCX and PDF)
- Inherent and residual risk ratings
- Evidence results with source citations
- Issues with severity, owner, and due date
- Document health report
- Weekly negative news digest
- Excel and CSV exports
Questions
Common questions.
Does Kobalt replace our vendor risk questionnaire?
You no longer need to send one. Instead of waiting on a vendor to answer a questionnaire, Kobalt maps your controls to the documents the vendor already provided and pulls the answer to each one straight from the evidence — every finding cited to its source. Your team reviews results instead of chasing responses.
What documents can it read?
SOC 1 and SOC 2 reports, contracts and MSAs, certificates of insurance, data processing agreements, policies, pen test summaries, and anything else in PDF, Word, Excel, image, audio, or video form.
How do analysts stay in control?
Every AI result is a proposal with a citation. Analysts accept or override it, exceptions are recorded with a reason, and the review history is append-only.