Third-Party Risk Lifecycle
- Onboarding, due diligence and continuous monitoring
- Inherent risk assessment and tiering
- Residual risk scoring and third-party exit
- Risk exception tracking, approvals and escalation
Rohan Kalyan · TPRM Portfolio Lead, Deloitte USI
Third-Party Risk
& Cybersecurity
Consultant
From assessment execution to risk-led portfolio ownership.
Owning the end-to-end TPRM lifecycle — onboarding, due diligence, continuous monitoring, exception tracking and third-party exit — across global technology, software and BFSI supplier portfolios, and validating GenAI-generated risk assessments as the domain subject-matter expert.
- TPRM
- Cybersecurity
- Technology Risk
- BFSI
- GenAI Risk
3 workstreams owned
5,500+ assessments in the first program
Assessor → QA → Team lead → Independent lead → Portfolio lead
- 500+ TPRM engagements delivered End-to-end lifecycle across global technology, software and network supplier portfolios
- 1,000+ Assessment reports QA-reviewed Reviewed for accuracy and control effectiveness across the portfolio
- ~20% Year-on-year fall in high-risk findings Through proactive remediation tracking and governance
- 15+ Analysts trained and mentored On TPRM process, assessment quality and risk-mindset principles
Career totals across the Deloitte USI tenure. Per-engagement figures — including 5,500+ assessments on a single program and a 57% turnaround reduction — are stated inside the case studies below, each scoped to its own engagement.
01 — Expertise
Six domains, evidenced by delivery
Each capability below is drawn from work actually performed on client engagements, not from framework familiarity.
Cybersecurity & Technology Risk
- Security control assessments and technical walkthroughs
- Evidence validation against ISO 27001 and NIST
- Severity-rated findings and reporting
- Assessment framework design and refinement
Risk & Control Governance
- Vendor obligation mapping to ISO 27001, NIST, GDPR and PCI-DSS
- Contractual and commercial arrangement oversight
- KPI monitoring and supplier performance escalation
- Root-cause analysis and remediation action plans
Privacy & Regulatory Risk
- Regulation-to-requirement mapping
- Regulatory gap identification
- Privacy assessment walkthroughs
- Support for regulatory requests and examinations
Senior Stakeholder Management
- Chief Control Office, Compliance, Legal and Risk
- Control Assurance and Procurement partnering
- Risk communication at senior executive level
- Managing objectives, service expectations and priorities
GenAI-Enabled Risk
- TPRM subject-matter validation of AI output
- Evidence grounding and traceability
- Failure-mode identification
- QA refinement loops and tooling UAT
02 — Career progression
Six stages of increasing ownership
Responsibility moved from executing assessments, to assuring their quality, to leading teams, to owning a supplier portfolio answerable directly to the client.
Delivering third-party assessments at volume
Executed reputational and contractual compliance assessments of business partners as third parties entered the client's ecosystem week over week.
- 5,500+ assessments
- 1,200+ third parties in scope
Rebuilding the throughput, then the regulatory baseline
Automated weekly intake and redesigned the assessment workflow, more than halving turnaround on that program. In parallel, mapped the privacy regulatory baseline into an assessable requirement framework with direct client stakeholders.
- 7h → 3h turnaround
- 8 regulations mapped
- Weekly intake automated
From performing assessments to assuring them
Ran privacy and cybersecurity walkthroughs for third-party developers, then moved into QA review and PMO coordination — accountable for the quality of other people's assessments as well as my own.
- 100+ assessed and QA-reviewed
- 4h → 2h assessment call
- Assessor → QA → PMO
Depth over volume, and a team to lead through it
Led deep-dive control assessments of ads measurement partners at roughly sixteen hours per third party, directing a three-person assessment team from evidence validation through severity reporting, remediation and SLA monitoring.
- 16 third parties
- 16 hrs per assessment
- 3-person team led
- End-to-end remediation
Direct accountability for a supplier portfolio
Progressed inside the enterprise TPRM program from assessor to QA to lead for three client-facing workstreams, and took portfolio-level ownership of the end-to-end lifecycle — inherent risk through due diligence, continuous monitoring, exception tracking and third-party exit. Advises Chief Control Office, Compliance, Legal and Risk stakeholders, and concurrently led a separate client's assessments independently.
- 3 client-facing workstreams
- 500+ engagements to date
- Inherent → control → residual
- Senior stakeholder ownership
Domain expertise applied to AI-generated risk output
Acting as TPRM subject-matter expert on an internal GenAI assessment accelerator: validating AI-generated assessment responses against source evidence, identifying the failure modes that undermine them, and feeding QA refinements back into the tool. AI-driven automation raised vendor onboarding efficiency by a quarter.
- TPRM SME
- AI output QA
- 25% onboarding efficiency
- Failure-mode identification
Also supported cost, revenue and recovery data analysis for a separate client in 2022 — high-volume dataset work, listed here as supporting experience rather than a flagship engagement.
03 — Selected work
Seven engagements, weighted by what they prove
Client identities are anonymised. Every figure is scoped to the engagement it belongs to. Where a detail was not documented it has been left out rather than estimated.
TPRM Portfolio Governance & Continuous Improvement
Ownership of the end-to-end third-party risk lifecycle across a global portfolio of technology, software and network suppliers for Fortune 500 and BFSI clients — onboarding through due diligence, continuous monitoring, exception tracking and third-party exit, with the risk and control framework governance that holds it together.
- 500+TPRM engagements
- 1,000+reports QA-reviewed
- ~20%YoY fall in high-risk findings
- 25%onboarding efficiency gain
- 15+analysts mentored
- Context
- A global supplier portfolio spanning technology, software and network relationships, assessed and governed on behalf of Fortune 500 and BFSI clients.
- Why it mattered
- A portfolio only carries assurance value if every third party in it has a complete, current risk profile. The work is as much about maintaining that profile over time as about the initial assessment.
- My role
- Senior Consultant and TPRM Portfolio Lead — managing and executing the lifecycle rather than performing discrete assessments within it.
- Scope
- Over 500 TPRM engagements delivered; over 1,000 assessment reports QA-reviewed for accuracy and control effectiveness.
- Approach
- Inherent risk assessment → due diligence → continuous monitoring → risk exception and approval tracking → third-party exit. First-level assurance through control-issue analysis, root-cause identification and remediation action plans, with KPI monitoring across the portfolio and escalation of performance issues to senior stakeholders.
- Frameworks
- ISO 27001 · NIST · GDPR · PCI-DSS · SOC 2 — used to map vendor obligations under contractual and commercial arrangements.
- Tools
- ServiceNow and risk management applications; AI-driven automation within the assessment workflow.
- Stakeholders
- Chief Control Office, Compliance, Legal, Risk, Control Assurance, Procurement and business stakeholder groups; supported global regulatory requests and examinations alongside regulatory teams.
- Challenges
- Holding governance deadlines and escalation requirements across a portfolio large enough that exceptions, approvals and monitoring cadence compete for the same attention as new assessments.
- Outcome
- High-risk findings down approximately 20% year on year through proactive remediation tracking; assessment turnaround reduced 15% and vendor onboarding efficiency improved 25% through AI-driven automation and workflow optimisation; 15+ analysts trained and mentored, with team productivity and assessment accuracy up around 10%.
- Career significance
- The shift from owning assessments to owning a portfolio — and from reporting findings to being answerable for the governance framework that produces them.
Governance boundary. Risk profiles were maintained, findings evidenced, exceptions tracked and escalations raised. Final risk acceptance remained with the client.
Enterprise Third-Party Risk Assessment Program
Progressed from assessor to QA to lead of three client-facing workstreams inside the client's enterprise TPRM program, owning risk from inherent rating through residual score and remediation.
- 3workstreams led
- 3role escalations
- Directclient accountability
- Context
- An enterprise third-party risk assessment program run for a technology and media client, assessing third parties across the client's ecosystem under a consistent methodology.
- Why it mattered
- The program gives the client a comparable, evidence-based view of the risk carried by every third party it onboards, rather than a set of one-off opinions.
- My role
- Assessor, then QA reviewer, then lead for three client-facing workstreams. Part-time on the program until October 2025, full-time since.
- Scope
- Three concurrent workstreams with direct accountability to the client.
- Approach
- Stakeholder intake → inherent risk assessment → evidence and control evaluation → residual risk scoring → findings and reporting → remediation and escalation.
- Frameworks
- ISO 27001 · NIST
- Tools
- Client TPRM tooling; participated in user acceptance testing of AI assessment tooling.
- Challenges
- Sustaining assessment quality across three workstreams while the program's requirements changed, which meant adapting process rather than defending it.
- Outcome
- Three role escalations within the same program, ending in ownership of three workstreams and a direct reporting line to the client.
- Career significance
- The move from executing assessments to owning risk workstreams — the point at which the work became accountable rather than assigned.
Governance boundary. Findings and severity ratings were assessed, evidenced and reported. The decision to accept, mitigate or exit each risk remained with the client.
Ads Measurement Partner Deep-Dive Assessments
Sixteen-hour technical control assessments of measurement partners, leading a three-person team from evidence validation through remediation closure and SLA monitoring.
- 16third parties
- 16 hrsper assessment
- 3assessors led
- Context
- Deep-dive assessments of ads measurement partners handling client data, commissioned by the same technology and media client.
- Why it mattered
- Measurement partners sit close to sensitive data flows, so surface-level questionnaire review was not sufficient assurance.
- My role
- Senior Consultant leading a three-person assessment team, including mentoring and QA review of their output.
- Scope
- Sixteen third parties, at approximately sixteen hours of assessment per third party.
- Approach
- Control evaluation with evidence validation, severity-rated findings, then remediation management and SLA monitoring through to closure.
- Challenges
- Holding technical depth across sixteen long-form assessments while managing team throughput, review quality and remediation SLAs at the same time.
- Outcome
- Full lifecycle coverage — assessment, finding, remediation and closure — rather than assessment reports handed off at the point of issue.
- Career significance
- First sustained team leadership, and the engagement that established depth rather than volume as the basis of the work.
Third-Party Developer Assessments
Privacy and cybersecurity walkthroughs of third-party developers, moving from assessor into QA review and PMO coordination.
- 100+assessed and QA-reviewed
- 4h → 2hassessment call
- Context
- Assessment of third-party developers building against the client's platform, covering both privacy and cybersecurity requirements.
- My role
- Assessor, then QA reviewer, then PMO — responsible for assessment quality and program coordination as well as delivery.
- Scope
- Over one hundred assessments assessed and QA-reviewed.
- Approach
- Privacy and cybersecurity walkthroughs with the developer, followed by questionnaire and process redesign to remove time that was not producing risk signal.
- Outcome
- Assessment call time halved, from four hours to two, without reducing assessment scope.
- Career significance
- First move into quality ownership — being answerable for what other assessors produced.
Business Partner Risk & Contractual Compliance
High-volume reputational and contractual compliance assessment of business partners, rebuilt into a faster, automated intake process.
- 5,500+assessments
- 57%turnaround reduction
- Context
- Reputational and contractual compliance assessment of business partners entering the client's third-party ecosystem.
- Why it mattered
- Third parties were entering the program continuously; assessment capacity, not assessment method, was the constraint.
- Scope
- More than 5,500 assessments delivered on this program, against an intake of over 1,200 third parties.
- Approach
- Sustained high-volume assessment execution, with weekly intake automated and the assessment workflow redesigned around it.
- Outcome
- Turnaround per assessment reduced from seven hours to three — a 57% reduction on this program — at unchanged volume.
- Career significance
- Established delivery scale, and the habit of treating a slow process as a problem to redesign rather than absorb.
Privacy Regulatory Framework Mapping
Translated privacy regulation into an assessable requirement framework, built with client stakeholders to survive future regulatory change.
- 8regulations mapped
- Reusablegap-identification framework
- Context
- The client needed privacy regulation expressed as requirements that could actually be assessed against, not cited.
- Scope
- Eight regulations mapped in the initial scope.
- Approach
- Regulatory research, then regulation-to-requirement mapping, developed through direct interaction with client stakeholders.
- Outcome
- A framework the client used for gap identification and designed to absorb future regulatory updates rather than be rebuilt for them.
- Career significance
- Earliest regulatory translation work and earliest direct client stakeholder ownership.
Independent Assessment Leadership
Led third-party assessments for a separate client without senior oversight, and designed the pointed assessment framework used to run them.
- Independentcall leadership
- 16 hrsper assessment
- Context
- Third-party assessments for a separate client, run over ten months alongside the enterprise TPRM program.
- My role
- Independently led the assessment calls, refined and designed the pointed assessment framework, and mentored and QA-reviewed other assessors.
- Scope
- Three third parties, at approximately sixteen hours of assessment each.
- Career significance
- Independence rather than volume: leading client-facing assessment calls unsupervised, and shaping the assessment approach itself rather than applying one.
Included as evidence of independent ownership and framework design. The engagement was deliberately small and is not presented as a volume achievement.
04 — Method
How I govern and assess risk
Two sequences run at once. The lifecycle governs the relationship from onboarding to exit; the assessment sequence governs what happens inside any single risk review.
The relationship — third-party lifecycle
- 01 Onboarding & inherent risk
- 02 Due diligence
- 03 Continuous monitoring
- 04 Exception tracking & approvals
- 05 Third-party exit
The review — inside a single assessment
-
01
Business context
What the third party does, what data and systems it touches, and how the business depends on it.
-
02
Inherent risk
Exposure before any control is credited — data sensitivity, criticality, access and regulatory reach.
-
03
Control evaluation
The controls actually claimed, assessed against ISO 27001, NIST, GDPR and PCI-DSS expectations.
-
04
Evidence validation
Whether the artefacts support the claim. A policy is not a control; a control without evidence is not assurance.
-
05
Residual risk
What exposure remains once validated controls are applied to the inherent rating.
-
06
Remediation & escalation
Severity rated, owners agreed, progress monitored against SLA, and what stays open escalated.
05 — GenAI & TPRM
Domain expertise applied to AI-generated risk assessment
Deloitte internal · GenAI TPRM Accelerator · 2025 – Present
My role TPRM subject-matter expert, evidence validation and output QA. Not model engineering — the contribution is the domain judgment that tells you when an AI-generated risk assessment is wrong.
Input
Third-party evidence and documentation
Model
GenAI analysis of the submitted evidence
Output
AI-generated TPRM assessment response
SME validation
Every response tested back against the source evidence
Failure modes identified and fed back
- Evidence misunderstanding
- Hallucinated controls
- Incorrect ISO / SOC interpretation
- Missed exceptions
- False compliance signals
- Ambiguous-document handling
- Weak evidence grounding
QA loop
Refinements returned to the tool and re-tested
Result
Assessment output that is evidence-backed and defensible
The value is not that a model can draft a risk assessment. It is that someone who has run several thousand of them can tell when the draft is wrong, name why, and make the next one defensible.
06 — About
Background
I am a Senior Consultant and TPRM Portfolio Lead at Deloitte USI, working across third-party risk, cybersecurity and technology risk. Based in Gurgaon, India.
My work started in high-volume assessment delivery — several thousand third-party assessments and the process redesign that made them faster — then moved into quality assurance and PMO responsibility, then into deep-dive control assessments leading a three-person team through remediation. I now own the end-to-end TPRM lifecycle across a global portfolio of technology, software and network suppliers for Fortune 500 and BFSI clients: onboarding, due diligence, continuous monitoring, exception tracking and third-party exit.
That means maintaining complete risk profiles rather than issuing point-in-time reports, and working directly with Chief Control Office, Compliance, Legal, Risk and Control Assurance stakeholders — including support for global regulatory requests and examinations.
Alongside that I am the TPRM subject-matter expert on an internal GenAI assessment accelerator, validating AI-generated assessment output against source evidence and identifying the failure modes that make it unreliable.
Download résuméCertifications held
- ISO 27001 Lead ImplementerTÜV SÜD
- Certified in Cybersecurity (CC)(ISC)²
In progress
- CRISCExam scheduled
- CISSPTraining completed
- ISO 42001 AI Governance Lead AuditorTraining completed
- AI Strategist — Prompt Engineering & Applied AITraining completed
Frameworks & standards
Platforms
Recognition
- 3 Applause Awards · 4 Spot AwardsDeloitte, for TPRM portfolio delivery and client value creation
- RFP development & TPRM solution designFor technology and BFSI clients globally
Education
- PGDM, IT & MarketingBalaji Institute of Modern Management, Pune · 2018–2020
- B.Tech, Mechanical EngineeringSUSCET, Mohali · 2014–2018
Languages
07 — Contact
Open to conversations
Third-party and vendor risk, technology risk, cybersecurity GRC, financial-services risk and AI-enabled risk programs.
Email
rohankalyan13254@gmail.com
LinkedIn
rohan-kalyan-01b66615a
Phone
+91 99886 87028
Based in
Gurgaon, India
Résumé
Download PDF