Extended GRC
MeshThird
Third-party assessment from onboarding to monitoring, with due diligence, questionnaires and criticality linked to the risk register.
- MeshThird
- Critical suppliers
| Supplier | Assessment |
|---|---|
| Alfa Transport | Completed |
| Beta Cloud | Overdue |
| Delta Accounting | In progress |
| Gama Print | Completed |
If your third-party management still works like this
- Due diligence done once and forgotten?The supplier was assessed at contracting and never again, even after changing owners or services.
- Third-party questionnaires by email?Answers in different spreadsheets, with no deadline and no comparison between suppliers.
- Every supplier treated the same?The same effort goes to the print shop and to whoever hosts the ERP.
- Supplier risk far from the area's risk?Procurement knows about the problem, but it doesn't show up in the risk register.
What MeshThird does
Criticality rating
Service, data accessed and dependency criteria set the assessment level for each supplier.
Due diligence
Checks on registration, owners and restricted lists, with the result recorded on the supplier.
Questionnaires
Templates by criticality, answered by the supplier in its own portal, with no license.
Periodic reassessment
Review deadline by criticality level, with a reminder to the contract owner.
Link to risks
A finding in the assessment becomes a risk in the register of the area that depends on the supplier.
Continuity
A critical supplier points to the continuity plan that covers its failure.
The supplier answers in one place.
Each supplier receives the questionnaire for its level, answers in a portal and attaches evidence. The assessor compares answers and asks for more on the item itself.
- MeshThird
- Nuvem Beta
- Security questionnaire
- Do you hold ISO 27001 certification?Yes, certificate attachedApproved
- Is the data kept in Brazil?São Paulo regionApproved
- Backup restore test in the last year?Being scheduledAttention
What changed at the supplier shows up before renewal.
Registration, ownership and restricted lists are checked at onboarding and review. A relevant change alerts the contract owner.
- MeshThird
- Transportadora Alfa
- Due diligence
- 02/2026Due diligence completed · no findingsApproved
- 09/2026Change in ownership structureAttention
- 09/2026Reassessment opened for the contract ownerPending
Illustrative screens with fictitious data.
Aligned with what regulators ask of third parties
Assessment proportional to criticality, as required by the Brazilian Anti-Corruption Law (Law 12,846/2013) and BACEN rules on contracting relevant services.
The AI suggests, the assessor decides
Mesh Intelligence summarizes questionnaire answers and flags differences between what the supplier declared and the documents sent. The final rating is always made by a person.
Fits with
- MeshRiskA living risk matrix, linked to the controls that mitigate each risk and the findings that challenge it.
- MeshComplyEach regulator's obligations mapped and combined. Where two rules overlap, the sum of their requirements applies.
- MeshResilienceBusiness continuity: impact analysis, recovery plans, testing and crisis management.
Questions from third-party managers
Does the supplier need a license to answer?
No. They only access their own questionnaire, in their own portal.
Can I use my own questionnaire?
Yes. Templates are configurable by criticality and type of service.
How is the supplier linked to risk?
Each supplier points to the areas that depend on it. A finding in the assessment becomes a risk in those areas' register.
See MeshThird with a case from your industry
The demo is led by the founder, who has seven years of internal and external audit experience.
Modules are licensed separately. The platform comes with all of them.