de.iterate is an Australian GRC platform with third-party and vendor risk management built in. Every supplier that touches your data or keeps your services running carries some of your risk. de.iterate keeps them all in one register, with security scoring, due diligence and risk assessments attached to each supplier record.
Instead of managing policies in one place, risks in another, evidence in folders, and audits through a last-minute scramble, de.iterate connects the whole system. That means better visibility, clearer ownership, stronger assurance and less time lost to manual admin. The current platform spans policies, assurance tasks, registers, evidence, reporting, Trust Centre capabilities, auditor access and support for multiple frameworks.
We help you get your ducks in a row.
“It’s probably fine”
Your supplier due diligence is a questionnaire sent in 2023 and a general feeling that everything’s probably fine.
Larger organisations have a third-party risk program, and it covers the suppliers it was designed for. Procurement onboards them, security assesses the ones tagged critical, legal holds the contracts, and the platform lists 1,400 vendors with a tier against each. Tier 1 gets a questionnaire every year. Tiers 2 and 3 were assessed once, at onboarding, by whoever was in the role at the time. Renewals go through without a reassessment, because renewal sits with procurement and assessment sits with security, and the two systems have never been introduced.
Meanwhile, most of your suppliers have added AI features since you last checked, and nobody has asked where your data goes now.
Supplier risk stays manageable when every supplier has an owner and a review date, the due diligence lives on the supplier’s record rather than in an inbox, and you can see what each supplier touches before anything goes wrong. de.iterate is built around that. Suppliers link to the risks, assets and incidents they relate to, questionnaires and assessments sit on the record where the next reviewer will find them, and reviews come due on a schedule rather than when someone remembers.
Record each supplier with an owner, review dates and custom fields for whatever your procurement team tracks. Link suppliers to the risks, assets and incidents they relate to, so when a supplier has a bad day you can see straight away what it affects.
Send supplier questionnaires as custom checklists directly from de.iterate, and keep the responses on the supplier record where the next reviewer or auditor will look for them (and find the relevant evidence).
Using de.iterate, you can run a supply chain risk assessment for each supplier and link it straight to the supplier record, so the assessment and the relationship stay together.
Score each supplier's security, then use dashboard widgets to show your supply chain risk at your next management review.
Each supplier carries a review cycle and an owner. de.iterate tracks the next review date, reminds the owner before it falls due and flags anything overdue, so a reassessment happens before the contract renews rather than being discovered after it.
Start from questionnaire templates written by our GRC experts, including questions on AI, and where your data is stored and processed. Tailor them to each supplier tier, so the questions you ask today cover the risks suppliers have added since 2023.
A risk register with a pulse, with inherent and residual scoring, heatmaps and risk appetite.
Every obligation traced to the evidence that meets it, across 25+ frameworks.
Plain-English policies, clear approvals and proof your staff have read them.
Scheduled controls testing, with the evidence ready before your auditor asks.
ISO 42001, AI impact assessments and an inventory of the AI in your business.
Find your personal information, see where it goes and keep your privacy policy current.
ISO 9001, ISO 14001 and ISO 45001, running alongside everything else you manage.
