Guiding third-party risk with clarity and integrity.
Independent counsel for organizations building, maturing, or rescuing a vendor risk program — grounded in 20+ years of practitioner experience, not slideware.
North Star TPRM Advisors is an independent third-party risk management consultancy built on more than two decades of hands-on experience in vendor risk, control testing, contract negotiation, and cyber risk. We help organizations design, run, and mature vendor risk programs that hold up under regulator, auditor, and board scrutiny — without the overhead of a Big Four engagement.
Every engagement is led personally by a practitioner who has owned a TPRM program from the inside, not handed off to a junior analyst billed at partner rates.
Deputy CISO and third-party risk leadership experience at federally regulated financial institutions — including a top-10 U.S. bank, the world's largest credit union, and the nation's top SBA 7(a) lender by dollar volume — with direct board and executive-committee risk reporting and service as a Federal Examiner Liaison to the OCC and FRB. Member, Shared Assessments Global Advisory Board, and a conference speaker on third-party risk management, with a CISO Executive Certificate from Carnegie Mellon's Heinz College.
Build or benchmark a vendor risk program against ISO 27036, NIST, and regulatory expectations — OCC, FFIEC, NYDFS, GDPR/CCPA vendor provisions.
Inherent and residual risk scoring, tiering frameworks, and continuous — not just annual — monitoring design.
SOC 2 / ISO 27001 evidence review, control testing methodology, and audit-ready documentation your assessors will accept.
Vendor contract review and negotiation support for security, privacy, SLA, and right-to-audit terms — a rare skill among GRC consultants.
Dashboards and reporting frameworks that translate vendor risk into language executives and boards actually act on.
Workshops for risk, procurement, and vendor management teams on assessment methodology and negotiation skills.
Due diligence and ongoing oversight for AI-enabled vendors and embedded models — risk questionnaires, control expectations, and governance frameworks aligned to NIST AI RMF and ISO/IEC 42001.
Hands-on experience evaluating, implementing, and training teams on AI-enabled TPRM and GRC platforms — automated risk scoring, AI-assisted evidence and questionnaire review — with the human oversight and audit trail regulators expect.
Mid-market and enterprise organizations standing up or maturing a TPRM function; regulated industries facing exam or audit pressure; and companies that need senior TPRM leadership on a fractional or project basis.
Two decades running TPRM programs from the inside — every recommendation has been tested against a real audit, a real regulator, a real vendor breach.
Contract negotiation experience that most GRC consultancies simply don't offer — risk language that survives legal review and procurement pressure alike.
No junior bench, no scope inflation. You work directly with the person who did the work — priced accordingly.
Whether you're building from scratch, preparing for an exam, or need experienced TPRM leadership on a flexible basis — reach out for a no-obligation conversation.