A third-party risk program everyone can stand behind
From the analyst chasing a questionnaire to the board asking how exposed we are, every role works from one vendor record and gets a straight answer.
1,500+ clients · 48 countries · 25 years in GRC
-
1,500+
Clients across 48 countries
-
50%
Of clients in the Fortune 500
-
65%
Of organizations putting more effort into quantification
-
15,000+
Members in the Archer risk community
The whole vendor relationship on one record every role can read
The answer sits in three places. One person holds the questionnaire, another the contract, and a slide gets rebuilt when the board asks. Archer keeps the relationship on one record, so nobody argues about whose number is right.
-
Analysts log the work once, not in three places
-
Directors get a current view without the rebuild
-
The board gets an exposure view you can defend
What the analysts, directors, and executives each get out of it
Archer connects third-party findings to the issues, controls, and enterprise risk your team already runs.
Analysts: less busywork
Tiering sets the depth before diligence starts, checklists carry over from the last vendor like this one, and the portal collects the evidence.
Directors: a current view
One view holds every third party, engagement, risk rating, and open task, so you answer the hard question in the meeting instead of chasing it after.
Executives: one platform
Vendor risk lands in the same register, control library, and issue queue your other teams already run, so oversight rises without another tool to buy.
Follow one vendor through the whole program, from request to exit
Archer ties every step of vendor management into the programs and processes your risk team already owns.
1
Supplier intake
A business user proposes a vendor on a short form that captures the service, the requesting unit, and how sensitive the work is, so you start with context.
2
Risk tiering
The relationship owner answers across eight areas of risk, from data sensitivity to regulatory exposure, and the score decides how deep the diligence goes.
3
Reusable checklists
Build the required document list once for an engagement type and apply it every time, and Archer opens a document record for each item the checklist selected.
4
Vendor responses
Questionnaires and document requests go out as a secure link, vendors bring in their own colleagues to answer, and the responses sync back to the engagement.
5
Residual risk
Analysts rate how well the vendor’s controls hold up, and that rating pulls inherent risk down to a residual number you can hold against your own tolerance.
6
Metric thresholds
Set red, amber, and green thresholds on any SLA, KPI, or KRI, name the metric owner, and Archer generates the collection task on the frequency you picked.
How different roles work in Archer
For risk analysts
A request arrives, the relationship owner scores inherent risk, and the tier picks the checklist. Vendors answer and upload evidence in the portal, you rate how well their controls work, and the engagement carries a residual number into contract talks.
For program leaders
Diligence is not the end. Watch SLAs, KPIs, and KRIs against thresholds you set, reassess when a relationship shifts, and see open work in one place. With Archer Evolv, anyone with permission can ask the record a question instead of queuing a report.
For executives and the board
Every tier decision, control rating, and termination sits on the record with the history behind it, so the exposure you review traces back to the analysts who did the work. The framework aligns to OCC Bulletin 2023-17 and NIST SP 800-161 Rev. 1.
The images used above are not actual product screenshots.
Everything you need, nothing you don’t
Archer carries every record and workflow a third-party program needs to work.
-
Third-party profiles
Analysts log it once, everyone else sees it
-
Engagement risk register
Each service you buy, scored on its own risk
-
Vendor response portal
Vendors answer without an Archer login of their own
-
Documents and expirations
Evidence with an owner and an expiry date
-
Security risk monitoring
Outside-in security ratings between reviews
-
Offboarding on the record
An ended relationship leaves an audit trail
What each of these roles gains over spreadsheets and point tools
Archer connects vendor risk to the broader programs a point tool cannot reach.
Analyst: one place to do the work
Basic coverage for teams just getting started.
Here’s what you get
-
Yes
Analyst: vendors answer without hand-holding
Built for teams that need real-time visibility and control.
Here’s what you get
-
Yes
Director: coverage and open work in one view
Spreadsheets, shared drives, and tribal knowledge.
Here’s what you get
-
Yes
Explore Our Case Studies
Eastern Bank Uses Archer to Drive Business Processes and Streamline Compliance
- View case study:
- View case study: Banorte Bank Gains Accurate Picture of Risk with Archer
- View case study: Intuitive Surgical Migrated to Archer SaaS for their journey to empowered risk management
- View case study: Operational Resilience for Financial Services Institutions
More than 1,500 organizations run on Archer®, including half the Fortune 500 and 37 of the top 50 global banks. See what their teams were up against, what they built, and what changed.
Eastern Bank Uses Archer to Drive Business Processes and Streamline Compliance
Banorte Bank Gains Accurate Picture of Risk with Archer
Intuitive Surgical Migrated to Archer SaaS for their journey to empowered risk management
Operational Resilience for Financial Services Institutions
Trusted by the teams who carry the risk
Risk, compliance, and audit leaders on what changed after Archer Evolv.
We recognized the need for a GRC software platform that would be central to our ability to improve and transform our enterprise risk and compliance processes.
Archer is the source of truth, and it creates a nice audit trail for us. As an insurance company, we're audited by every governmental entity. Now we can say, here's our repository, take a look.
Risk aggregation is a big point for us, to see where our risk is located within the organization, and to give greater visibility for boards and executives.
Turkcell is using Archer as the main GRC tool in the company. It provides us a transparent and safe governance framework.
Archer gives us the ability to boil things down into numbers and specifics versus generalities. It's management by fact versus intuition or feel.
It connects all the different applications together, so you can use those cross-references and connections to make better business decisions, because you have it all in one place.
Questions we hear most often
Straight answers to what third-party risk program leads ask before choosing Archer.
You can edit the questions, adjust the values behind the scoring, and add your own, so the assessment reflects how your program judges risk. Teams with a question bank usually port it over, and adoption follows a workflow analysts recognize.
No. Archer Engage for Vendors sends each contact a secure link to answer questionnaires and upload documents from outside your instance, and they can invite their own colleagues to help. Their answers sync back to the engagement for your review.
Tier them. The inherent risk questionnaire scores each engagement across eight areas, including data access, regulatory exposure, and business criticality. Higher tiers draw deeper diligence and more reassessment, and low-risk work clears fast.
Third-party findings become issues in the same queue your other teams work, engagement risks map to your enterprise risk register, and third parties map to the processes they support. One platform, so vendor risk stops living in a program of its own.
The tier decision, the evidence behind it, the control rating, the open issues, and the termination sit on the engagement with the history attached. The framework aligns to OCC Bulletin 2023-17 and NIST SP 800-161 Rev. 1, which examiners recognize.
Archer Evolv grounds its answers in your own records, roles, and permissions rather than a general model’s average, and it shows the trace behind an answer. A person reviews and approves before anything on the record changes.
Most teams start with the prescriptive framework already in the solution, which covers profiles, engagements, inherent risk, due diligence, and monitoring out of the box. Scope drives the timeline, and your team confirms it during scoping.
