Glossary

Definitions of key terms used in the Aprovall API and the TPGRC domain.

A

Attribute: Customizable property associated with a ThirdParty. Examples: purchase amount, criticality, business unit, supplier type.

Compliance: State of a third party that meets all regulatory and documentary requirements defined by the client. Can be OK, KO or under evaluation.
Context: Frame in which a client works with a third party — contract, tender, project, regulation — and under which evaluations are triggered. A primary entry point, like the third party: a context can exist without a third party, and the relationship between third parties and contexts is many on both sides.
Context template: Account-level template that defines a context type (label, code, description, email body) and the set of attributes to fill in. A context is bound to exactly one template.
Criticality: Level of importance of a third party for the organization. Generally defined as High, Medium or Low.

Document: Supporting document requested from a third party as part of an assessment. Examples: Kbis, URSSAF certificate, bank details, insurance certificate.
Dossier: Structured set of documents requested from a third party for a specific assessment. A dossier has a status that evolves based on third party responses.

ESG: Environmental, Social, and Governance - Non-financial assessment criteria measuring a company's environmental, social and governance impact.
Evidence: Response provided by a third party to a document request. Can be a file, attestation or declaration.
Evaluation: Process of analyzing a third party based on provided documents and calculated indicators.

Indicator: Metric or status calculated for a third party. Examples: Bank Details, Carbon, Cyber, Financial Risk, Overall Compliance.

Kbis: Official document certifying the legal existence of a French company, issued by the commercial court registry.

Rank: Position of a third party in a context's tree. The client's direct supplier has rank 1, the subcontractor it declares has rank 2, and so on. A context attribute populated automatically.
RIB: Relevé d'Identité Bancaire - Document containing a company's bank details (French bank account statement).

SIRET: Unique 14-digit identification number assigned to each establishment of a French company.
Supply Chain Discovery: Cascading declaration of the supply chain: every third party asked declares its own subcontractors, until the whole chain has been discovered. A subscription option, triggered from a context.

ThirdParty: External entity with which an organization maintains a business relationship: supplier, subcontractor, partner, service provider.
TPGRC: Third-Party Governance, Risk & Compliance - Discipline of managing third-party risks, including assessment, monitoring and compliance.
TPRM: Third-Party Risk Management - Process of managing risks associated with third-party relationships.

URSSAF: Union de Recouvrement des cotisations de Sécurité Sociale et d'Allocations Familiales - French organization collecting social security contributions. The URSSAF certificate proves that a company is up to date with its contributions.

Webhook: Real-time notification mechanism for receiving events (status change, new document, etc.) on a configured URL.