# Contrata

> Third-party risk management software for teams assessing, monitoring and managing service providers.

## Product

Contrata brings provider records, assessments, supplier engagement, evidence and reporting into one workspace. The assistant handles requests, follow-ups and record-keeping. Risk teams review the evidence and decide which risks to accept, mitigate or escalate.

## Features

- Provider records: ownership, service arrangements, linked critical operations and review dates.
- Assessments: supplier and internal team collaboration, bulk document uploads and source-backed answers.
- Monitoring: news, financial and breach registers, and provider websites checked against the organisation's risk framework.
- Engagement: supplier requests, replies, attachments and follow-up questions.
- Evidence: original files and supplier messages linked to the relevant assessment.
- Reporting: reports built for an audience and format from provider records and evidence; Explorer connects related records.
- Risk memory: prior evidence, decisions and team feedback inform later reviews. Conflicting sources are surfaced for human review.

## CPS 230

Contrata supports the work involved in service provider oversight for CPS 230. Using the software does not itself establish compliance; the organisation remains responsible for its risk framework and decisions.

## Pages

- [Homepage](https://www.contrata-automation.io/)
- [About Us](https://www.contrata-automation.io/about)
- [Resources](https://www.contrata-automation.io/blog)
- [Published article index](https://www.contrata-automation.io/blog/articles.json)
- [Sitemap](https://www.contrata-automation.io/sitemap.xml)

## Published Resources

- [Check a supplier’s accessibility evidence before buying software](https://www.contrata-automation.io/blog/supplier-accessibility-evidence-review)
- [Contrata Engage: follow up with suppliers without closing the risk too soon](https://www.contrata-automation.io/blog/contrata-engage-supplier-clarification)
- [Track supplier software end-of-support before it becomes an exception](https://www.contrata-automation.io/blog/supplier-software-end-of-support)
- [Bullhorn recovery: five supplier-continuity checks](https://www.contrata-automation.io/blog/bullhorn-supplier-continuity-checks)
- [Review a SaaS service-level agreement before relying on its uptime promise](https://www.contrata-automation.io/blog/review-saas-service-level-agreement)
- [Time-box a supplier security exception before onboarding](https://www.contrata-automation.io/blog/supplier-security-exception-before-onboarding)
- [Inherent vs residual vendor risk: a worked assessment example](https://www.contrata-automation.io/blog/vendor-inherent-residual-risk-assessment)
- [Vendor due diligence questionnaire template for Australian risk teams](https://www.contrata-automation.io/blog/vendor-due-diligence-questionnaire-template)
- [Check supplier data deletion before closing the exit](https://www.contrata-automation.io/blog/supplier-data-deletion-exit-evidence)
- [Risk themes: putting your risk framework to work](https://www.contrata-automation.io/blog/risk-themes-risk-framework)
- [ASD Essentials has launched: what changes in supplier evidence reviews?](https://www.contrata-automation.io/blog/asd-essentials-supplier-evidence-transition)
- [Review supplier privileged access before the next support session](https://www.contrata-automation.io/blog/supplier-privileged-access-review)
- [CPS 230 evidence checklist for lean risk teams](https://www.contrata-automation.io/blog/cps-230-evidence-checklist)
- [Turn a supplier acquisition notice into a risk review](https://www.contrata-automation.io/blog/supplier-acquisition-risk-review)
- [Assess supplier financial resilience without relying on one score](https://www.contrata-automation.io/blog/supplier-financial-resilience-review)
- [Prepare internal audit to review a proposed critical-operation outsourcing](https://www.contrata-automation.io/blog/cps-230-internal-audit-outsourcing-review)
- [Manage cohorts of small suppliers whose combined impact matters](https://www.contrata-automation.io/blog/cps-230-supplier-cohort-risk)
- [Assess related-party services without assuming they are low risk](https://www.contrata-automation.io/blog/cps-230-related-party-service-providers)
- [Check supplier recovery beyond the system restart](https://www.contrata-automation.io/blog/supplier-recovery-backlog-reconciliation)
- [Close supplier remediation actions with evidence](https://www.contrata-automation.io/blog/supplier-remediation-closure-evidence)
- [Read supplier assurance reports for scope and exceptions](https://www.contrata-automation.io/blog/supplier-assurance-report-review)
- [Handle a supplier data breach without losing the operational picture](https://www.contrata-automation.io/blog/supplier-data-breach-response)
- [How to classify material service providers in a super fund](https://www.contrata-automation.io/blog/cps-230-superannuation-material-service-providers)
- [Check an AI-assisted supplier assessment before approving it](https://www.contrata-automation.io/blog/human-review-ai-supplier-assessment)
- [Assess a supplier’s AI use before it changes your critical service](https://www.contrata-automation.io/blog/ai-supplier-due-diligence)
- [CPS 230 offshoring review: questions beyond data location](https://www.contrata-automation.io/blog/cps-230-offshoring-arrangement-review)
- [Stress-test shared cloud dependencies across different suppliers](https://www.contrata-automation.io/blog/shared-cloud-concentration-risk)
- [What to check when a supplier changes a subcontractor](https://www.contrata-automation.io/blog/supplier-subcontractor-change-review)
- [Set supplier review priorities when the risk team is small](https://www.contrata-automation.io/blog/supplier-risk-review-prioritisation)
- [Collect missing supplier evidence without restarting the questionnaire](https://www.contrata-automation.io/blog/supplier-evidence-targeted-follow-ups)
- [Reuse supplier evidence across CPS 230 and CPS 234 carefully](https://www.contrata-automation.io/blog/cps-230-cps-234-supplier-evidence)
- [Build a supplier-risk board report around decisions](https://www.contrata-automation.io/blog/third-party-risk-board-report)
- [Write a third-party risk decision someone else can challenge](https://www.contrata-automation.io/blog/third-party-risk-decision-record)
- [Build a supplier-incident intake that supports timely escalation](https://www.contrata-automation.io/blog/cps-230-supplier-incident-escalation)
- [Monitor an outsourced claims service between formal reviews](https://www.contrata-automation.io/blog/cps-230-outsourced-claims-monitoring)
- [CPS 230’s 2026 non-traditional provider relief: what to check](https://www.contrata-automation.io/blog/cps-230-non-traditional-provider-relief)
- [Map fourth-party dependencies without an endless supplier list](https://www.contrata-automation.io/blog/cps-230-fourth-party-dependency-mapping)
- [Exercise a general insurer’s outsourced claims disruption](https://www.contrata-automation.io/blog/cps-230-insurer-claims-disruption-test)
- [Test a super fund administrator exit before you need it](https://www.contrata-automation.io/blog/cps-230-super-fund-administrator-exit)
- [Review a life insurer's material service provider contract](https://www.contrata-automation.io/blog/cps-230-life-insurer-contract-review)
- [CPS 230 due diligence for an outsourced claims provider](https://www.contrata-automation.io/blog/cps-230-claims-provider-due-diligence)
- [Map a bank's critical operation to its supplier dependencies](https://www.contrata-automation.io/blog/cps-230-bank-critical-operation-supplier-mapping)
- [Material provider or material arrangement? A CPS 230 example](https://www.contrata-automation.io/blog/cps-230-provider-versus-material-arrangement)
- [Keep your CPS 230 material service provider register current](https://www.contrata-automation.io/blog/cps-230-material-service-provider-register-maintenance)