Why implementing a portal in your third-party risk management program makes sense

When companies invest in GRC (governance, risk, and compliance) automation technology, they often focus on benefits for power users—such as cybersecurity teams managing controls, compliance, audits and policy frameworks. However, the occasional users—leaders needing high-level reports, contributors submitting evidence periodically, and vendors completing questionnaires—are equally critical to the success of third-party risk management (TPRM) and a portal is the key.

A well-designed GRC portal addresses the needs of all user groups through a streamlined interface. Here are five ways a GRC portal simplifies TPRM while enhancing efficiency and security across the organization.

1. Automating and Expediting TPRM Questionnaire Completion

Manual processes for vendor questionnaires often lead to delays and inefficiencies. For example, the team at American Express Global Business Travel (Amex GBT) previously struggled with inefficiency caused by numerous emails from multiple teams, each containing different surveys, reminders and requests for information. This fragmented approach often left vendors uncertain about what was being asked of them and what remained outstanding.

To solve for these challenges, Amex GBT implemented a secure vendor portal featuring app-based questionnaires. Now, vendors receive a single notification email when they are assigned a new task. After logging in with their portal credentials, vendors gain access to a centralized dashboard that clearly displays all current requests, outstanding items, and completed tasks. This central view eliminates confusion, allowing vendors to easily track what is required and monitor their progress.

While the initial notification process remains the same, the portal’s enhanced visibility and organization have already begun to improve the overall experience for vendors.

As Amex GBT continues to roll out this solution, early feedback suggests that the streamlined process is making collaboration more efficient and transparent for all involved. According to Deloitte’s 2023 TPRM survey, 63% of organizations identified improving third-party risk assessment methods as a top priority, highlighting the need for efficient tools like GRC portals.

2. Enhancing Security for Sensitive Information

Third-party portals often involve hundreds or thousands of users accessing sensitive information. Without proper safeguards, this can pose significant security risks. Amex GBT leveraged both user- and document-level privileges to ensure that vendors only access information relevant to their organization, but they found greater efficiency by securely transitioning from a single-user (“one”) approach with the survey to a team-based approach with the portal. Now, multiple vendor users can be added to the portal and are able to collaborate on necessary, access-based tasks. Although the questionnaire is initially sent to a specific person, all team members associated with that vendor have access and can contribute to completing the required work.

To support this, they implemented a hub-and-spoke model:

1. 1. The vendor record acts as the hub.
   2. All portal users linked to that vendor record can view and work on everything related to that vendor record (the spokes) such as vendor requests, surveys, questionnaires, action items, and findings.

This model ensures greater collaboration and transparency for vendor-related activities within the portal. It also aligns with best practices from TPRM frameworks that require companies to protect data against breaches caused by third parties. By restricting access and implementing read-only fields for sensitive data, organizations can reduce exposure while maintaining transparency.

3. Improving User Experience with Custom Branding and Intuitive Design

Amex GBT recognized the importance of maintaining a familiar user experience for vendors, auditors, and employees accessing the Portal. Using Onspring’s flexible design tools and no-code development, Charlie Evans, Information Technology Risk and Information Security Manager, and his team applied Amex GBT’s branding across all the portal pages, application views and emails.

“It was easy to add Amex GBT branding throughout the Onspring Portal using a custom app layout,” Evans said. “Users see our banner with the logo across the top of all portal pages, app views and emails. It gives our vendors confidence that they’re in the right place for our GRC program.”

Custom branding is not just aesthetic—it contributes to operational efficiency by reducing confusion and frustration during portal navigation.

“We wanted it to be a website experience that is well organized and structured, so users can easily find everything they need,” Evans added.

4. Tracking TPRM Progress with Dashboards and To-Do Items

Staying on top of TPRM tasks becomes significantly easier with a GRC portal that visualizes data in dashboards. These dashboards display charts, graphs, and task summaries, giving users a quick snapshot of their progress.

“One of our key tenets for this Portal was making it really easy for people to just pop in, see the work they have due, access those tasks and complete the work,” Evans said.

Real-time insights into vendor risks are critical for prioritizing actions effectively. Dashboards show active reports and outstanding tasks, enabling users to focus on what needs to be done. Evans emphasized that avoiding empty reports was a key design goal, ensuring that dynamic reports feed into the app and provide only relevant information.

5. Extending GRC Functionality to Partners and Vendors

While initially built for vendors, Amex GBT’s portal was modular enough to accommodate partners and other stakeholders quickly. Within a week, they adapted the portal interface for partners to access tailored information while maintaining the same intuitive design principles.

This flexibility demonstrates how GRC portals can evolve alongside organizational needs. Advanced GRC platforms provide scalability that supports both internal risk management and external relationships.

Streamlining a Portal for All Third-party Risk Management

A well-designed portal in a GRC solution can simplify third-party risk management while enhancing security and usability for all stakeholders—from occasional users to power users.

By automating processes like questionnaire completion, improving data security, enhancing user experience, and extending functionality beyond vendors, companies can strengthen their risk management programs while fostering collaboration across their ecosystem.

Want to see how Onspring Portal can elevate you GRC program? Schedule a personalized demo today.