Know exactly where your program stands, and what to fix first.
Mersli Consulting reviews your TPRM program against current and proposed interagency guidance, or the frameworks that apply to your industry, and delivers a prioritized roadmap your team can act on immediately. Fixed scope, fixed price, and minimal disruption to your team.
For leaders who need a clear answer, fast
Risk, compliance, and procurement leaders at banks, credit unions, and fintechs with bank partners.
We also work with organizations in other industries that want to mature their third-party risk programs or close gaps.
- An exam or audit is coming and you're unsure your vendor oversight will hold up.
- A recent exam or audit raised third-party risk findings.
- Your TPRM software is in place, but the process behind it isn't working.
- Your program grew piece by piece and lacks clear ownership.
- For banks, credit unions, and fintechs: you want to get ahead of the proposed 2026 interagency TPRM guidance and its focus on risk-based tailoring.
Assessed against 2023 guidance and the proposed 2026 framework
The 2023 interagency guidance remains in effect. We also assess against the framework in the proposed 2026 guidance, so your program is ready either way.
Outside banking, we assess against the regulations and frameworks that apply to your industry, confirmed during scoping.
Risk identification and assessment
Your vendor inventory, how risks are identified, and how vendors are tiered by the likelihood and severity of harm.
Risk oversight
Due diligence, contracting, ongoing monitoring, and termination, and whether effort is scaled to each vendor's risk.
Cross-cutting areas
Subcontractors, operational resilience, insurance and indemnification, and use of consultants, consortia, or certifications.
Residual risk acceptance
How decisions to accept remaining risk are made and documented.
Governance
Roles, risk appetite, board and management reporting, documentation, and independent review.
Process and tools fit
Where your process and your TPRM software don't line up, with configuration needs flagged for your software provider.
Five deliverables, in hand by Day 15
Written for the people who have to act on them: your team, your leadership, and your board.
- Current-state assessment. A clear picture of how your program works today.
- Gap analysis. Each gap rated by regulatory and operational risk, plus areas where you can scale back effort on lower-risk vendors.
- Prioritized roadmap. Actions for the first 30, 60, and 90 days, plus a 12-month plan, with suggested owners.
- Executive summary. A short, plain-language brief for leadership or your board.
- Readout session. A walkthrough of findings and recommendations with your team.
Three weeks, four phases
The 15 business days start when your documents arrive. Your team's time is concentrated in the first week, and you'll get a short written status update every week.
Kickoff and document request
We confirm scope and send a short document request. Day 1 starts when your policies, procedures, and vendor inventory arrive.
Discovery
We review your documents, select the sample of vendor assessments, and schedule short interviews with key team members.
Process review
We test the sample vendor assessments against your policies and hold the interviews to see how the process runs day to day.
Gap analysis
We compare your program against regulatory expectations, rate each gap, and identify where effort can be scaled back.
Roadmap and readout
We deliver the roadmap and executive summary, then walk your team through it.
What we'll need from you
- Documents within 5 business days of kickoff. Policies, procedures, your vendor inventory, and a sample of vendor assessments.
- Key staff available for interviews. Short sessions during Days 4–8 with the people who run your program day to day.
- One point of contact. Someone who can answer quick questions and help us get what we need.
If documents or interviews run late, the timeline moves with them, and we'll tell you right away.
One fixed price. No surprises.
The full 15-day Diagnostic: assessment, gap analysis, prioritized roadmap, executive summary, and readout session.
- No hourly billing. Your written proposal confirms the price and scope before anything starts.
- Larger programs. For organizations with more than 500 active vendors, we'll confirm scope in your proposal.
- After the Diagnostic. Program design and remediation, managed through our PMaaS approach, and ongoing TPRM advisory are available and scoped separately.
Get a written proposal in two business days
Complete the short intake form. No call required to get started.