Risk treatment, four options, and only one of them is a plan

Avoid — do not use the vendor, or do not use it for this purpose. The option most often ruled out for commercial reasons and most often correct when the exposure is a critical process with a weak supplier and no alternative.

Reduce — require remediation, or add controls on your side: restrict the data shared, tighten the integration, monitor more closely. Share — move part of the exposure through contractual liability, indemnities or insurance, remembering that transferring financial consequence does not transfer regulatory accountability or the operational outage. Accept — decide the residual risk sits within appetite, and record who accepted it, when, and until when.

Treatment is where third-party risk programmes leak. The finding is raised, the vendor agrees to fix it, and then the trail ends: no owner on your side, no deadline, no evidence requirement, no consequence for missing it. Six months later the same finding reappears in the next assessment and is raised again as though it were new.

What closes the loop is unglamorous: a named owner on both sides, a due date derived from severity rather than negotiated per case, a defined piece of evidence that constitutes proof, and escalation that actually fires when the date passes. That mechanism — actions, deadlines, evidence, SLA tracking — is what TARA's treatment and SLA work automates, because the reason it fails by hand is volume rather than intent.