Account for how using third parties creates risks and characterise a third-party risk management framework that works well.
The idea
Using a third party lets a firm buy capability, scale and cost savings, but it does not transfer accountability. The firm stays answerable to customers and regulators for the outsourced activity. Third parties also add new risks. These are loss of direct control and visibility, and dependence on the provider's people, systems and controls. They also include fourth-party risk, which comes from the provider's own subcontractors, and concentration risk when many firms or many functions rely on the same provider. A framework that works well keeps a complete inventory of providers. It tiers them by how critical the service and the data are rather than by contract value. It performs due diligence before onboarding and writes in audit rights, service levels, incident notification and exit terms. It also monitors continuously and tests exit and substitution plans. The usual mistake is treating onboarding diligence as the whole job. Exam point: risk management follows the whole lifecycle, and responsibility cannot be outsourced.
A practice question
A bank outsources its payment processing to a specialist provider under a signed contract. Which statement about responsibility for the outsourced activity is correct?
- The bank remains accountable to customers and regulators for the activity. - correct
- Accountability passes to the provider once the contract is signed, because the provider now performs the activity.Why not: Treats the contract as a transfer of accountability; only the work is transferred, not the responsibility.
- Accountability is shared equally with the provider, and the bank is liable only for half of any resulting loss.Why not: Invents an equal split of accountability; regulators do not recognise a fractional transfer of responsibility.
- Accountability passes to the provider if the contract contains an indemnity clause covering operational losses.Why not: Confuses a contractual indemnity, which may recover some loss, with a transfer of regulatory accountability.
Outsourcing transfers the performance of a task, not responsibility for it. An indemnity may help recover losses but the firm stays answerable to customers and supervisors.
A harder one
A bank has 400 vendors and limited oversight resources. Which approach to tiering vendors best fits an effective third-party framework?
- Rank vendors by annual contract value and apply full due diligence only to the largest contracts.Why not: Uses spend as the criterion; a cheap vendor with access to customer data or a critical process can be far riskier.
- Apply identical due diligence to all vendors so that no vendor is treated unfairly or missed.Why not: Ignores proportionality; uniform treatment wastes resources on trivial vendors and under-covers critical ones.
- Tier vendors by the impact of failure on critical services and data, and scale diligence to the tier. - correct
- Rank vendors by how long they have served the bank and relax monitoring for the longest-standing ones.Why not: Uses tenure as a proxy for safety; a long relationship does not reduce the impact or likelihood of failure.
Effective frameworks tier providers by criticality and data sensitivity (impact of failure), then scale diligence and monitoring. Contract value and tenure are poor proxies for risk.
The hardest tier
A bank onboarded a critical data-hosting vendor three years ago after thorough due diligence that it passed with no findings. Since then the bank has performed no review. The vendor has since replaced its data centre operator with a new subcontractor and had a major control failure at another client. Which weakness in the bank's framework is most direct?
- The initial due diligence was performed, so the framework is effective and the failure is outside the bank's control.Why not: Treats point-in-time diligence as sufficient; a vendor's risk profile changes after onboarding.
- Risk was assessed only at onboarding, with no ongoing monitoring or reassessment. - correct
- The bank chose a vendor that was too large, and vendor size alone is the cause of the control failure.Why not: Assumes size causes the control failure; the stem describes a lifecycle gap, not size.
- The bank relied too heavily on contractual service levels and should have relied on regulatory approval instead.Why not: Invents a regulatory approval route; the weakness described is missing ongoing monitoring, not a missing approval.
Third-party risk must be managed across the lifecycle. A change of subcontractor and an incident at another client should trigger reassessment, which an onboarding-only process cannot deliver.
In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.
Start free →