Vendor Risk · Supplier Risk · Bangladesh
Third-Party Risk Assessment in Bangladesh
Know which of your Bangladesh vendors, suppliers and service providers could hurt you, and by how much. We map your third parties, rank them by risk, assess the ones that matter most, and track every gap until it is closed.
Definition
What Is a Third-Party Risk Assessment?
A third-party risk assessment is a structured review of the risks that an outside company, such as a vendor, supplier, contractor or service provider, brings to your business, covering security, financial, legal, operational, reputational and ESG risk, so you can decide whether to work with them and on what terms.
It is one part of third-party risk management (TPRM): the ongoing cycle of listing your vendors, ranking them by risk, assessing them, fixing gaps and monitoring them over time. For foreign companies working in Bangladesh, local vendors often handle payroll data, payments, goods or customer contact, so their weaknesses become yours.
of data breaches studied in Verizon's 2025 Data Breach Investigations Report involved a third party, double the share in the 2024 report.
Source: Verizon 2025 DBIR, 12,195 confirmed breaches analysed.Six risk domains
What a Third-Party Risk Assessment Covers
Each vendor is scored on six domains. The weight of each domain depends on what the vendor does for you: a payroll provider is weighted on data, a garment supplier on labour and safety.
Cybersecurity and data
Access controls, encryption, incident history, how they store and share your data.
Financial health
Solvency, tax filings, bank standing and how dependent they are on your business.
Legal and regulatory
Licences, registrations, litigation and compliance with Bangladesh law.
Operational resilience
Capacity, key people, backups, business continuity and their own subcontractors.
Reputation and integrity
Ownership, sanctions and PEP screening, adverse media and anti-bribery controls.
ESG and labour
Workplace safety, wages, working hours and environmental practices.
Risk tiering
Assessment Depth Follows Risk
Not every vendor needs the same scrutiny. We first measure inherent risk, the risk before any controls, using five questions:
- Does the vendor touch personal or confidential data?
- Would your operations stop without them?
- How much do you spend with them?
- Are they in a regulated activity?
- How hard are they to replace?
The answers set the tier, and the tier sets how deep the assessment goes.
Light review
- Short questionnaire
- Registration and sanctions check
- Review every 2 to 3 years
Standard assessment
- Full questionnaire with documents
- Financial and ownership checks
- Policy and certificate review
- Review every year
Deep assessment
- Everything in Tier 2
- Site visit and evidence testing
- Continuity and incident plans tested
- Fourth-party review
- Yearly review plus ongoing monitoring
Typical tiering model. Frequencies are agreed with you and can follow your buyer or regulator requirements.
How it works
The Third-Party Risk Management Lifecycle
- InventoryList every vendor, what they do and what data or systems they touch.
- TierScore inherent risk and place each vendor in Tier 1, 2 or 3.
- AssessQuestionnaires, document review, registry and sanctions checks, and site visits for critical vendors.
- RemediateAgree fixes with owners and deadlines, and record the residual risk you accept.
- ContractRecommend clauses for audit rights, data protection, subcontracting and exit.
- MonitorRe-assess on schedule and watch for changes such as ownership, litigation or adverse news.
Bringing on a new vendor? Pair this with vendor onboarding and KYB, and manage performance after signing with strategic vendor management.
Local checks
Bangladesh-Specific Checks Global Questionnaires Miss
Standard vendor questionnaires are written for the US and Europe. In Bangladesh we add checks against local registries, tax records and Bangla-language sources, and we visit the vendor when it matters.
Deliverables
What You Receive
Clear outputs your procurement, compliance and security teams can act on, and that auditors and buyers can review.
| Vendor | Domain | Finding | Inherent to residual | Owner | Due |
|---|---|---|---|---|---|
| Payroll provider | Cybersecurity | No multi-factor login on payroll system | High→Low | Vendor IT | 30 days |
| Logistics partner | Operational | No backup carrier for peak season | Med→Low | Your ops lead | 60 days |
| Garment supplier | ESG and labour | Overtime records incomplete | High→Med | Supplier HR | 45 days |
| IT support firm | Legal | Contract has no audit or exit clause | Med→Low | Your legal | At renewal |
Example rows from a risk register. Residual risk is the expected level once the agreed fix is in place.
FAQs
Third-Party Risk Assessment: FAQs
Need wider support with regulatory and payment risk? See compliance and risk mitigation.
What is a third-party risk assessment?
It is a structured review of the risks a vendor, supplier, contractor or service provider brings to your business, covering security, financial, legal, operational, reputational and ESG risk. The result tells you whether to work with them and on what terms.
How is third-party risk assessment different from supplier due diligence?
Supplier due diligence is usually a one-time, in-depth check before you sign. Third-party risk assessment ranks all your vendors by risk and repeats the review over time. For a pre-contract deep check, see our supplier due diligence service.
What is fourth-party risk?
Fourth parties are your vendors’ own vendors and subcontractors. If your payroll provider uses a cloud host that is breached, your data is exposed even though you never signed with that host. We ask critical vendors to list and control their key subcontractors.
What is the difference between inherent and residual risk?
Inherent risk is the risk a vendor carries before any controls, based on what they do for you. Residual risk is what remains after their controls and any agreed fixes. You decide whether the residual risk is acceptable.
How often should vendors be reassessed?
Most companies review critical vendors every year and monitor them in between, medium-risk vendors every year or two, and low-risk vendors every two to three years. Any major change, such as new ownership or a breach, should trigger an early review.
Which frameworks do you follow?
We align with ISO/IEC 27036 for supplier security, NIST SP 800-161 for supply chain risk, and common industry questionnaires. If your company or your buyer has its own questionnaire, we use that.
Does Bangladesh law require vendor risk checks?
Bangladesh’s personal data protection law makes the company that shares personal data with a vendor responsible for how that vendor handles it, and regulated sectors such as banking have their own rules on outsourcing. Ask your legal adviser which rules apply to you.
Can you assess vendors we already use?
Yes. Most clients start with existing vendors. We build the inventory, tier everyone, and assess the critical vendors first.
Know your vendors
Book a Third-Party Risk Assessment
Send us your vendor list, or the vendors you are about to sign. We will propose tiers, scope and a fixed fee in writing.
BPO Bangladesh · Suite 610, 5th Floor, Rupayan Shopping Square, Bashundhara R/A, Dhaka 1229 · +880 1711-990020