Third-Party Risk

A distributor uses one warehouse company for all orders, so if that facility closes unexpectedly the distributor may miss customer deliveries even though the failure happened outside its own offices. This is an operational third-party risk.

Other exposures differ: a payroll provider may hold sensitive data, an agent may act improperly, and a manufacturer may deliver unsafe parts, so the third party's role and the harm of failure determine the right checks. Start with a list of material relationships, including services purchased outside central procurement, subcontractors when relevant and businesses with access to data or systems, because a contract register without owners or current service descriptions is hard to use.

Assess criticality before collecting a stack of questionnaires by asking what happens if the service stops, whether customers are affected and how long replacement takes, since a vendor with little spend can still be critical if it runs a core system. Due diligence checks claims before a relationship starts or expands, and NIST describes researching pertinent supplier and product information to support informed choices in cybersecurity supply chains, with the depth tailored to the type and scale of risk.

Evidence may include financial information, business continuity plans, references, certifications, security reviews and site visits, but a clean questionnaire is a lead, not proof that controls work, so verify important claims where practical. Contracts should define deliverables, service expectations, data handling, incident notice and termination rights as needed, because they cannot eliminate every failure but can make responsibilities and access to information clearer.

Legal review may be warranted for high-impact arrangements. Concentration matters, since two suppliers with different names can depend on the same cloud platform, factory or logistics route, and mapping only direct contracts may leave a common point of failure unnoticed.

A backup should be usable, because a name on a contingency list does not mean spare capacity, compatible systems or permission to move data, so test switching steps for the most critical services. Monitor after onboarding by reviewing performance, incidents, financial warning signs and changes in ownership or subcontracting, with the amount of review reflecting how rapidly the risk can change.

An OCC interagency guide for banks describes a third-party risk lifecycle and notes that relationships differ in criticality, and its banking rules are not a universal legal requirement for other businesses, though the general idea of proportionate oversight is still useful. Assign a relationship owner who can act on warnings, since procurement may keep the contract, IT may assess security and operations may see delivery problems first, and their signals should be brought together for material vendors.

Risk scores need context, because a 'medium' score across many areas may conceal one severe dependency, so record the scenario, likely impact, controls and remaining exposure rather than relying only on a heat-map colour. One illustrative metric is critical-party spend divided by total third-party spend, so $4 million of $10 million is 40%, but this does not measure actual risk because a low-cost sole-source provider may be the most dangerous dependency.

Consider exit before there is a crisis by asking whether the business can retrieve its data, replace the service and preserve customer commitments, since contractual transition support and a tested export process can be more useful than a vague right to terminate, and when an incident occurs, coordinate response with the provider and define contact routes and information needs beforehand. Small firms need not copy bank-size programmes and can list their ten most consequential partners, check key claims and plan for failure, but they should not assume outsourcing transfers all responsibility, since a contract can allocate duties between parties without making harmed customers whole automatically or settling regulatory obligations, so for owners the task is to know who matters most, verify important promises and have a credible response if one partner fails.