Contract management and third party risk indicators, each written so two organisations measuring it arrive at the same number. Every KPI carries one of four classifications, which tells you what the measure is for rather than how important it is.
The small set the board sees. Each one, on its own, would change a decision.
Explains movement in a key KPI. Read alongside, not in isolation.
Measures whether the required practice happened before the risk was taken. Forward looking.
Surfaces what has already gone wrong, so it can be corrected and counted.
| Ref | Indicator | Definition | Class | Cadence |
|---|---|---|---|---|
| K-01 | Critical third parties with a current risk assessment | Share of third parties tiered critical whose assessment is within its validity period. | Key | Monthly |
| K-02 | Contracts with a tested exit plan | Share of critical contracts where an exit or step-in plan exists and has been tested in the last 24 months. | Key | Quarterly |
| K-03 | Concentration exposure of the ten largest providers | Combined annual contract value of the ten largest providers as a share of total third party spend. | Key | Quarterly |
| K-04 | Residual risk above appetite | Number of third party relationships whose residual rating exceeds the stated appetite, with no accepted exception. | Key | Monthly |
| K-05 | Overdue remediation actions | Number of agreed remediation actions past their due date, weighted by the criticality of the third party. | Key | Monthly |
| K-06 | Contract value under active management | Share of total contract value held in the repository with a named owner and a review date. | Key | Quarterly |
| S-01 | Assessment turnaround time | Median working days from questionnaire issued to assessment signed off. | Supporting | Monthly |
| S-02 | Onboarding lead time for a critical third party | Median calendar days from request to contract signature for critical relationships. | Supporting | Monthly |
| S-03 | Contracts in the central repository | Share of known contracts stored in the repository with complete metadata. | Supporting | Monthly |
| S-04 | Renewal notice lead time | Median days between renewal decision and the contractual notice deadline. | Supporting | Monthly |
| S-05 | Third parties reporting against SLA | Share of critical third parties delivering agreed service reporting on schedule. | Supporting | Monthly |
| S-06 | Assessment reuse rate | Share of assessments satisfied by an existing certification or a shared assessment rather than a new questionnaire. | Supporting | Quarterly |
| S-07 | Cost of the assurance programme per critical third party | Total programme cost divided by the number of critical relationships assessed. | Supporting | Annual |
| P-01 | Due diligence completed before signature | Share of new contracts where risk assessment was completed and recorded before the signature date. | Prescriptive | Monthly |
| P-02 | Approved clause library usage | Share of new contracts drafted using the approved clause set without unlogged deviation. | Prescriptive | Quarterly |
| P-03 | Screening coverage at onboarding | Share of new third parties screened for sanctions, adverse media and beneficial ownership before onboarding. | Prescriptive | Monthly |
| P-04 | Criticality tiering completeness | Share of active third parties carrying a current criticality tier. | Prescriptive | Monthly |
| P-05 | Policy training completion | Share of contract owners who have completed third party risk training in the last 12 months. | Prescriptive | Quarterly |
| P-06 | Subcontractor disclosure obtained | Share of critical contracts where material subcontractors are disclosed and recorded. | Prescriptive | Quarterly |
| P-07 | Register accuracy at register close | Share of register entries reconciled against accounts payable at period close. | Prescriptive | Quarterly |
| D-01 | Incidents attributable to a third party | Number of operational or security incidents where a third party is the identified cause. | Detective | Monthly |
| D-02 | SLA breaches per quarter | Count of contractually defined service level breaches, split by severity. | Detective | Quarterly |
| D-03 | Expired certifications or evidence | Number of third parties whose required certification or evidence has lapsed. | Detective | Monthly |
| D-04 | Findings reopened after closure | Number of assessment findings closed and later reopened within 12 months. | Detective | Quarterly |
| D-05 | Contracts auto-renewed without review | Number of contracts that renewed automatically with no documented review. | Detective | Quarterly |
| D-06 | Unapproved third parties in use | Number of active suppliers identified in payments data but absent from the register. | Detective | Quarterly |
| D-07 | Concentration drift | Number of critical services where a single provider's share grew more than ten points year on year. | Detective | Annual |
The full library as a spreadsheet, with formula, data source, owner, tolerance bands and a worked example per indicator.
Pick no more than eight key indicators. Everything else is supporting evidence for those eight.
Definitions are revised twice a year by the KPI working group. Corporate members hold a seat.