Third-Party Supplier Risk Re-Classification Using Multi-Model Semantic Voting and External Web Augmentation
Risk decisions in many third-party risk management (TPRM) workflows rely on static inherent risk questionnaires (IRQ). These static forms provide a snapshot of the vendor from the business users’ perspective, as these requests are processed without cross-referencing for evidence. Consequently, responses can be misinformed or embellished with inaccuracies, thereby masking the vendor’s true risk to the enterprise. This paper presents a multi-stage verification framework to augment IRQs with web evidence and a deterministic ensemble of large language model assessors to reclassify risk. In a case study of 100 submissions previously misclassified as low risk, the proposed framework correctly identified 76% of the cases as high risk, while the existing workflow identified none. McNemar’s continuity corrected statistics of 74 were obtained with a two sided p-value of 2.65 × 10-23, indicating a significantly more effective workflow compared to the legacy model.