Third-party risk management consulting

Focus your third-party risk program where the risk is.

Mersli Consulting helps banks, credit unions, fintechs, and other regulated organizations right-size their third-party risk programs: more rigor for high-risk vendors, less busywork for the rest. Fixed scope, fixed price.

See where your program stands Or book a 30-minute call
CTPRP-certified practitioner 7+ years in financial services TPRM Written proposal in 2 business days

Due diligence effort, by vendor tier

Illustrative. Percentages show each tier's share of vendors. Most programs spread effort evenly; right-sized programs follow the risk.

Typical todayRight-sized
CriticalAbout 5%
HighAbout 15%
ModerateAbout 30%
LowAbout 50%

Same team, same hours. Rigor moves to the vendors that can hurt you.

Who we help

Built for teams doing too much work on the wrong vendors

Specialists in financial services, with help for any organization maturing its TPRM program.

Our specialtyCommunity banksCredit unionsFintechs with bank partners
We also helpInsuranceHealthcareOther regulated industries
  • You have an exam or audit coming up and aren't sure your vendor oversight will hold up.
  • Your last exam or audit flagged third-party risk issues and you need a credible fix.
  • Your TPRM software is in place, but the process behind it isn't working.
  • Your team spends as much effort on low-risk vendors as on critical ones, so reviews pile up.
  • A client, auditor, or regulator is asking how you manage vendor risk, and you don't have a clear answer.
  • Your program grew piece by piece, and no one owns it end to end.
Services

Business process and compliance expertise for your TPRM program

We focus on how your third-party risk program works and whether it meets regulatory expectations. Your TPRM software provider handles system configuration; we work alongside them.

Start here
01

TPRM Program Diagnostic

$16,500flat fee · 15 business days from receipt of documents

One focused, three-week engagement that shows exactly where your program stands. We review your vendor inventory, risk-tiering methodology, due diligence coverage, concentration risk, policies, processes, and governance against the guidance that applies to you, including the 2023 interagency guidance and the proposed 2026 guidance for banks, credit unions, and fintechs.

  • Prioritized 30/60/90-day roadmap with suggested owners
  • Where you can scale back effort on lower-risk vendors
  • Executive-ready findings brief
  • Readout session with your team
See the full Diagnostic →
02

Program Design and Remediation

We turn the roadmap into a working program, managed through our Project Management as a Service (PMaaS) approach: a predictable schedule, clear owners, documented evidence, and weekly written updates.

  • Policies and procedures
  • Risk-tiering and due diligence standards
  • Governance and board reporting
  • Remediation of exam or audit findings
  • Policy rollouts and regulatory change projects
How PMaaS works →
03

Ongoing TPRM Advisory

A monthly or annual advisory service that keeps your program aligned as regulations and your business change.

  • Periodic process reviews
  • Regulatory change briefings
  • Exam and audit readiness check-ins
  • On-call advisory hours
About advisory →
We coordinate with your software provider on any configuration your new processes need, so your platform reflects how your program is meant to work.
What you get

See what the Diagnostic delivers

Sample pages from a TPRM Program Diagnostic. Written for the people who act on them: your team, your leadership, and your board.

Sample
TPRM Program Diagnostic

Gap analysis

Each gap rated by regulatory and operational risk, with a target window.

Risk tieringTiers are set by contract value, not the likelihood and severity of harm.High30 days
Ongoing monitoringCritical vendors aren't reviewed after onboarding.High30 days
Due diligenceThe same questionnaire goes to every vendor, regardless of risk.Medium60 days
Board reportingReports show activity counts, not risk or trends.Medium90 days

Scale back: 214 low-risk vendors can move to a lighter annual review.

Illustrative sample. Names, figures, and findings are examples, not client data.

See the full Program Diagnostic
How it works

A simple, predictable process

  1. Tell us where you are

    Fill out a short intake form. It takes about two minutes.

  2. Get a clear scope

    We send a written proposal with fixed scope, timeline, and price within two business days.

  3. We do the heavy lifting

    We review your program with minimal disruption to your team, with weekly written updates.

  4. Get your roadmap

    You receive a prioritized plan and a walkthrough session for your leadership team.

  5. Move forward your way

    Run the roadmap yourself, or have us build and support the program with you.

Why Mersli

Practitioner experience, not theory

Our founder is a Certified Third-Party Risk Professional (CTPRP) who has run this work day to day, not just advised on it.

We've done the job

We've sat in your seat and run this work day to day. We know what examiners and auditors ask for and what busy teams can realistically sustain.

We work alongside your software

We understand how TPRM platforms support a program, and how much more value they deliver when the process behind them is right. We fix the process and compliance side, and coordinate with your software provider on the rest.

Plain answers

You get a roadmap your team can act on, not a slide deck full of jargon.

AI where it helps

We use AI to speed up the analysis and documentation, so you get results faster without cutting corners.

Why now, for financial services

Third-party risk expectations are changing

For banks, credit unions, and fintechs, the proposed 2026 interagency guidance would shift the focus to risk-based tailoring. Know where your program stands before it's finalized.

2023
In effect

Interagency guidance on third-party relationships: the standard your examiners use today across the full vendor lifecycle.

2026
Proposed

A framework centered on tailoring oversight to each relationship's risk. We assess against both, so you're ready either way.

Next steps

Find out where your program stands

Not ready for a call? Start in writing. Answer a few short questions and we'll reply within two business days with our honest take on your program and whether we can help.

  • About two minutes to complete
  • A reply within two business days
  • No call required to get started

Prefer to talk? Book a 30-minute call

Not sure where you stand? Take the 3-minute readiness self-check

Preferred contact
We never share your information.

We review every request for potential conflicts of interest and may decline engagements where one exists.