An effective third-party risk management program must govern the entire lifecycle of the supplier relationship. This article examines seven phases: inventory, classification, due diligence, risk assessment, contract management, monitoring, and exit management.