Third-party due diligence read in full, with the gaps found before the contract is signed.
Bluegrass builds third-party risk systems for banks, credit unions and fintechs. The systems read a vendor's or partner's SOC reports, policies and contracts against your standards and the guidance that applies, and draft the assessment and follow-ups for your risk team.
For a sponsor bank, the same work covers fintech partners from onboarding through ongoing oversight, and examiners expect each review to be as thorough as the last.
What third-party due diligence involves today
Every vendor or partner, new or at its periodic review, sends SOC reports, policies, contracts and questionnaires. Someone has to read it all against your requirements, chase what is missing and write an assessment supporting a risk rating and approval.
The reading is slow, standards drift between reviewers and the queue grows with every relationship. Reviews then run late or thin, and those are the findings examiners write up.
How automated third-party review works
- 01
Collect the package
Documents are gathered from the vendor portal, email or your third-party risk system and identified by type before anything is read.
- 02
Read against your standards
Each document is checked against your requirements and the guidance for the relationship, such as information security or, for a fintech program, consumer compliance and financial crime controls.
- 03
Find the gaps
Missing documents, qualified opinions, control exceptions, contract terms below your standards and answers that contradict the evidence are listed, each with its source page.
- 04
Draft the assessment
An assessment is drafted in your template, with the gaps, the follow-up requests to the vendor and a summary for the approver.
- 05
Track and refresh
Open items are tracked to closure, and each periodic review starts from the previous assessment, so the reviewer sees what has changed.
Where people stay in the loop
Approving a vendor or partner, and its risk rating, stays with your third-party risk team and the business owner. Drafts are measured by how much the reviewer accepts, and new document types are tested on past reviews first.
The systems it works with
The system works with your third-party risk platform, or the shared drives and spreadsheets that stand in for one, and files each assessment and its evidence to the vendor record.
When to build it, and when to buy it
Third-party risk platforms are well established, and several now include AI document review, so an institution with a moderate number of vendors and a platform it likes may find those features sufficient.
A custom build makes sense when your standards and guidance mapping are specific, when fintech partner oversight needs more than vendor management software provides, or when the same document reading should serve other compliance reviews.
We hold no reseller agreements, partner quotas or revenue share with any vendor, so a recommendation to buy is made on its merits.
What this work costs you today
A quick way to put a number on the problem before talking to anyone, using your own figures rather than ours.
Enter your volume and the minutes each one takes to see what the work costs in a year.
The numbers stay in your browser and are not stored or sent anywhere. Bring the figure to the first call, since it is the baseline any system should be measured against.
Questions about third-party risk management
- Can it read SOC reports?
- It reads SOC 1 and SOC 2 reports in full, including the opinion, exceptions and complementary user entity controls you are expected to have, and lists anything that needs a response.
- Does it work for oversight of fintech partners?
- It serves a sponsor bank overseeing program partners, checking marketing, complaints and compliance reports against the program agreement and applicable regulations, at onboarding and on a schedule afterward.
- Which guidance does it check against?
- It checks against the guidance you follow, such as the interagency guidance on third-party relationships, together with your own policy. The mapping is built with your risk team and kept current as guidance changes.
Related systems
A senior team that has done this before
We are a small, entirely senior team with fifty years of combined AI engineering, multiple granted patents and Y Combinator founders, from Yale, MIT, McKinsey, Goldman Sachs, Microsoft and Vista Equity Partners. The people who scope your work are the people who write the code.
Selected work
We built the AI transformation roadmap for a top-50 P&C brokerage, and it is saving the firm millions of dollars in vendor fees it did not need to pay.
Clients include some of the largest banks, RIAs, fintechs and AI labs, as well as a top-3 P&C carrier, a top-10 P&C brokerage, a top-5 trucking brokerage, a leading specialty MGA and a leading trucking MGA.
We run only 3 to 5 engagements at a time, so that every client works directly with the senior team.
About the team- Dozens
- of insurance companies, RIAs, banks and fintechs we have worked with
- 50 yrs
- combined AI engineering experience
- 10+ Patents
- granted to members of the team
- 100%
- of the IP we build is assigned to you
Find out whether this is worth building for your business.
A 30-minute call with an engineer usually shows whether this is worth building. Within a week you will have a free written point of view, including whether a packaged product would serve you better.