ThirdPartyIQ watches the companies an organization depends on, every day, and says what to do when something changes.
Organizations are expected to monitor their third parties continuously. Yet the tools most teams use still run on periodic questionnaires that are labor-intensive for both sides and out of date the moment they are completed. The effort is enormous, the coverage is thin between cycles, and the answer arrives after it would have mattered.
We built ThirdPartyIQ to close that gap: automatically gathering the evidence, reading it, continuously sensing risk signals, reasoning across financial health, cybersecurity, sanctions, legal, reputational, and regulatory data, and delivering a specific, cited recommendation when risk emerges, instead of waiting for someone to catch it in a dashboard or at the next annual review.
01
Third-party documentation is retrieved on our customers’ authority and kept current as new versions are published, including for the third parties they pay but never assessed.
02
Every document is read in full and returned as cited findings: exceptions, controls pushed back onto the customer, scope gaps, subprocessors and fourth parties, and what changed since last time.
03
Each requirement the customer sets is verified against the evidence already gathered, with a citation and a confidence level, before anyone contacts the third party. The results map back to whichever assessment questionnaire the customer uses.
04
Six risk domains and every published document watched daily, weighed against what that third party actually does for the customer, delivered as findings with a recommended action.
Signals in one domain rarely mean much on their own. The platform correlates across all six, and against the evidence already on file for that third party.
Most platforms hand you feeds and scores. Agents retrieve the source documents, keep them current, and review them.
Agents assemble what is independently knowable about a third party and verify it against what the organization requires, before anyone is asked to fill out a form. The questionnaire is completed from the evidence, not the other way round.
Existing systems capture what a third party says about itself. Agents assemble what can be independently corroborated, and reconcile the two.
Risk data already exists. What is missing is the reasoning between the signal and the action.
We work alongside the GRC, third-party risk, and procurement systems organizations already have, and we work just as well for teams running on spreadsheets and email. Nothing to rip out.
Examination procedures are our product specification, which turns out to be the right specification for an audit too.
Every recommendation is evidence-cited. Every decision is logged. The audit trail of what triggered each action is exportable for examination or audit. The reasoning is ours to show. The decision stays with the organization.
Any organization accountable for the external relationships it depends on. We use “third parties” as our default term, covering vendors, suppliers, partners, commercial counterparties, and other external relationships.
We built for financial services organizations because they set the highest bar for third-party oversight. Building to that bar means the same discipline holds up in every other industry that depends on third parties.
Financial services we serve
Also serving
ThirdPartyIQ was founded by Carl McCauley and Chris Duden, who spent nine years building governance, risk, and compliance software for financial services organizations. Same buyers, same exam, same problem, approached from the other side. We know what it takes to earn a risk team’s trust.
Co-Founder & CEO
Nine years as CEO of 360factors, where he built it into an established governance, risk, and compliance software company serving regulated financial institutions, earning an exclusive American Bankers Association endorsement along the way. Earlier, leadership roles at Zycus in procurement, AFS Technologies in supply chain, and MetricStream in governance, risk, and compliance. Deep domain expertise in third-party risk, GRC, and the regulated compliance buyer.
Co-Founder & CTO
CTO of 360factors from day one, architect of its Predict360 GRC platform and its Kaia AI compliance platform, built from pre-product through enterprise deployment inside regulated financial institutions. More than 15 years of applied AI in regulated software, from early natural language processing and machine learning through predictive analytics and modern large language models.
The hardest part of third-party risk management is not understanding the risk. It is the volume, and the fact that the standard approach starts from zero every time. A questionnaire with hundreds of questions goes to every third party, regardless of what is already independently verifiable. Third parties receiving hundreds of these a year deprioritize the smaller requesters. Coverage lapses. The same risk that should have been visible months earlier surfaces in a finding.
Most available tools were built to digitize the questionnaire workflow: better tracking, cleaner documentation, faster routing. That is an improvement. It is not a transformation. The manual work stays. The annual cycle stays. The gaps between reviews stay.
ThirdPartyIQ starts from a different premise. Start from what you require of a third party, not from a questionnaire. Collect the evidence. Read it. Verify each requirement against it. Monitor it continuously. Ask a third party only what the evidence cannot answer. That is not a workflow efficiency. It is a structural change in how third-party risk gets done.
If we cannot cite it, we do not claim it. Every finding in the platform traces back to a source document or a monitored signal, and that citation travels with the finding into the file.
AI does the reasoning and shows its work. The platform reaches a conclusion, presents the evidence behind it, and waits. The organization owns the decision and the record of who made it.
We make the systems our customers already own more valuable. ThirdPartyIQ runs standalone for teams on spreadsheets and email, and as an intelligence layer above the GRC, third-party risk, and procurement systems already in place.
Not just the user at the desk. Every capability is judged against a single question: when this output appears in a file review, does it satisfy the standard or create a finding?
We take calls from third-party risk, procurement, compliance, and credit teams. Tell us where your program stands today, and we will tell you where ThirdPartyIQ fits.
Get in touchThirdPartyIQ. Austin, Texas.