ProcessUnity launches a controls-driven risk index
The new rating approach reflects a market shift toward combining external signals with evidence from the organization's own assessment and control process.
Third Party Current editorial graphic. Source material: ProcessUnity; analysis and presentation by Third Party Current.
A score with two evidence directions
The ProcessUnity announcement addresses a persistent problem in third-party risk: external observations and internal control evidence often live in separate views. External signals can identify change quickly but may lack business or control context. Assessments can provide context but age rapidly and depend on the quality of evidence and review.
A combined index is therefore a logical product direction. Its usefulness depends on whether users can inspect the contributing evidence, understand changes, and apply the result differently across relationship types. A composite number without explanation can create false precision even when the underlying data is extensive.
The demonstration buyers should request
Buyers should provide one representative third party and ask the provider to show how assessment evidence, external findings, materiality, and unresolved issues affect the index. The demonstration should include a changed signal, the explanation given to an analyst, the workflow triggered, and the historical record retained after review.
They should also ask how missing data is treated and whether the model behaves differently for small suppliers, private companies, subsidiaries, and fourth parties. Those cases expose whether the index supports judgment or simply compresses uncertainty.
The wider market signal
Workflow platforms and cyber ratings providers are converging around the same decision surface. Workflow vendors are adding external intelligence and summarized risk. Ratings vendors are adding assessments, collaboration, and remediation. Category labels remain useful, but buyers increasingly need to compare the complete path from evidence to action.
Third Party Current will track the Risk Index as a product change and look for later documentation on methodology, packaging, explainability, and workflow. We will not convert the company announcement into an independent performance claim.
What we will watch next
Third Party Current will watch for later primary-source evidence that changes the maintained company, capability, or standards record. The next useful evidence may include implementation documentation, release details, regulator findings, corrected methods, product packaging, customer-observable workflow, or a subsequent company statement. Until then, the dated source and its stated boundary remain attached to this analysis.
