North Star TPRM Advisors

Who We Are

North Star TPRM Advisors is an independent third-party risk management consultancy built on more than two decades of hands-on experience in vendor risk, control testing, contract negotiation, and cyber risk. We help organizations design, run, and mature vendor risk programs that hold up under regulator, auditor, and board scrutiny — without the overhead of a Big Four engagement.

Every engagement is led personally by a practitioner who has owned a TPRM program from the inside, not handed off to a junior analyst billed at partner rates.

B. Scott McMichael, JD — Founder & Principal

CISSP CISA CDPSE CIPP/US CIPP/C JD

Deputy CISO and third-party risk leadership experience at federally regulated financial institutions — including Capital One, Navy Federal Credit Union, and Live Oak Bank — with direct board and executive-committee risk reporting and service as a Federal Examiner Liaison to the OCC and FRB. Member, Shared Assessments Global Advisory Board, and a conference speaker on third-party risk management, with a CISO Executive Certificate from Carnegie Mellon's Heinz College.

20+

Years in TPRM & Cyber Risk

Full

Program Lifecycle Coverage

1:1

Principal-Led Engagements

TPRM

Sole Area of Focus

Core Capabilities

§01 — SERVICE LINES

PLATE 01

Program Design & Maturity Assessment

Build or benchmark a vendor risk program against ISO 27036, NIST, and regulatory expectations — OCC, FFIEC, NYDFS, GDPR/CCPA vendor provisions.

PLATE 02

Vendor Risk Assessment & Due Diligence

Inherent and residual risk scoring, tiering frameworks, and continuous — not just annual — monitoring design.

PLATE 03

Control Testing & Assurance

SOC 2 / ISO 27001 evidence review, control testing methodology, and audit-ready documentation your assessors will accept.

PLATE 04

Contract Negotiation & Risk Language

Vendor contract review and negotiation support for security, privacy, SLA, and right-to-audit terms — a rare skill among GRC consultants.

PLATE 05

Metrics, KPIs & Board Reporting

Dashboards and reporting frameworks that translate vendor risk into language executives and boards actually act on.

PLATE 06

Training & Education

Workshops for risk, procurement, and vendor management teams on assessment methodology and negotiation skills.

Engagement Models

§02 — HOW WE WORK

Program Build

Scope, design, and stand up a TPRM program from the ground up — vendor tiering, assessment methodology, and control testing framework.

Fixed-fee project

Fractional TPRM Lead

Ongoing, part-time senior TPRM leadership for organizations that need the expertise without a full-time hire.

Monthly retainer

Contract Negotiation Support

Hands-on negotiation of vendor security, privacy, and SLA terms on active deals.

Hourly or per-contract

Training & Workshops

Half- and full-day sessions for risk, procurement, and vendor management teams.

Day rate

Who We Serve

§03 — IDEAL ENGAGEMENTS

Mid-market and enterprise organizations standing up or maturing a TPRM function; regulated industries facing exam or audit pressure; and companies that need senior TPRM leadership on a fractional or project basis.

Financial Services Insurance Healthcare Fintech SaaS & Technology Regulated Manufacturing

Why North Star

§04 — DIFFERENTIATORS

Practitioner, Not Theorist

Two decades running TPRM programs from the inside — every recommendation has been tested against a real audit, a real regulator, a real vendor breach.

Negotiation Fluency

Contract negotiation experience that most GRC consultancies simply don't offer — risk language that survives legal review and procurement pressure alike.

Right-Sized Engagement

No junior bench, no scope inflation. You work directly with the person who did the work — priced accordingly.

Set a Course

Let's talk about your vendor risk program.

Whether you're building from scratch, preparing for an exam, or need experienced TPRM leadership on a flexible basis — reach out for a no-obligation conversation.

Email Us Connect on LinkedIn

scott@northstar3p.com