# Prepare a third-party risk committee

Gather indicators, prioritize topics and record decisions.

> **Access:** member. Subject to enabled modules and your plan.

## How do you prepare a vendor risk committee?

To prepare a vendor risk committee, gather critical third parties, recent assessments, risks requiring decisions and ongoing actions. Specify the period, scope and missing information. In CISAPP, start with indicators, then open detailed records to prepare traceable decisions.

## Preparation

Define the review period and vendor scope. Check that registers, criticality levels and activity relationships are current.

## Gather information

1. Open **Home** and refresh indicators.
2. Filter the vendor register for critical vendors or those needing assessment.
3. Review recent assessments and identify missing responses or evidence.
4. Filter risks by criticality and status.
5. Review exemptions expiring within 30 days.
6. Examine dependencies and concentration for important activities.
7. Prepare available exports with their dates and scopes.

![Reporting indicators for the review](https://docs.cisapp.eu/images/en/dashboard.webp)

*Indicators guide the review; decisions should rely on detailed records. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/dashboard.webp)*

## During the committee

For each topic, check context, the decision needed, owner and deadline. Distinguish established facts from missing data. Record actions in the relevant risks, controls or action plans.

## After the committee

Update decisions and deadlines. Assign actions and check they are visible to the relevant people. Keep useful documents in Files with appropriate permissions.

## Expected outcome

Each decision is linked to a subject and follow-up. The next review can establish what changed. This journey uses current views and does not require customizable dashboards.

Viewing exemptions requires organization-administrator access. If you do not have it, ask an authorized person to prepare that part of the review.

## Common questions

### What information should you present to the committee?

Present topics requiring a decision, their context, available evidence and proposed follow-up. Indicators guide the review; vendor records, assessments and risks explain individual situations.

### Can you prepare the committee without a customizable dashboard?

Yes. This journey uses the [current dashboard](https://docs.cisapp.eu/en/reporting/dashboard), registers and dependency views. It does not rely on a widget editor or a feature under construction.

### How do you follow up decisions after the committee?

Record decisions on the relevant risks, controls or action plans with an owner and deadline. Check access for people responsible for actions and retain useful documents. The next review should be able to find decisions and subsequent changes.

Explore more [questions about vendors, risk and compliance](https://docs.cisapp.eu/en/help/common-questions).