Third-Party Risk Management

A company outsources payroll to a vendor with access to employee records and bank instructions, which presents different risks from a supplier of office stationery. Third-party risk management asks what the dependency is, what could go wrong and who will follow it after signature.

Keep an inventory of material providers, recording services, data access, critical systems, business owner, contract and sub-providers where relevant, because an unknown vendor cannot be assessed or contacted quickly during an incident. Classify criticality before designing the questionnaire, since a critical cloud host may need security, continuity and exit checks while a low-impact purchase may need basic identity and payment controls but not a fifty-page cyber survey.

The US banking agencies interagency guidance describes a lifecycle and says risk practices should be proportionate to the bank profile and the activity criticality, though it applies to banks, not as a universal legal checklist for other businesses. Perform due diligence before commitment by verifying legal identity, relevant capability, financial resilience, references, security or privacy controls and regulatory status where needed, evaluating evidence rather than simply collecting yes-or-no answers.

The NIST 2026 supply-chain due-diligence guide discusses researching supplier and product information for informed decisions, with a focus on ICT suppliers, and its topics include ownership, provenance, resilience and cyber practices, while other vendor categories need different questions. Define risk ownership internally, since procurement may coordinate the process but operations, finance, security and legal may own different aspects, and a vendor score without someone accountable for action is a coloured spreadsheet.

Put material controls into the contract, including service levels, incident notice, audit or assurance rights, sub-contractor limits, data handling, termination and transition support, matched to risk and the provider's ability to perform them. Monitor after onboarding by reviewing performance, unresolved disputes, financial signals, breaches and material changes, because a strong pre-contract review can become stale after a merger, new sub-processor or product change.

Track dependencies beyond the direct contract, since a provider may rely on one data centre or specialist subcontractor, so ask about those dependencies for critical services and document uncertainty if visibility is limited. Plan for interruption, because backup processes, alternative vendors, data exports and internal skills can reduce reliance on one supplier, and a contract right to exit is not useful if the business cannot actually transition the service.

Identify concentration risk, since several apparently independent vendors may share the same cloud platform or shipping hub, so assess correlated failure when continuity matters rather than assuming diversity from separate logos. Use risk acceptance deliberately, because some exposure cannot be removed economically but leadership should know and record the decision, and an overdue assessment should not silently become approval.

An illustrative current-review rate is critical providers with an in-date documented review divided by critical providers identified, so if 36 of 40 qualify it is 90%, and the four exceptions should be investigated, particularly whether they hold sensitive data. Protect provider information, since security reports, financial statements and incident histories may be confidential, so control access while giving decision makers a concise summary of unresolved issues.

Trigger reassessment on contract renewal, scope changes or a serious incident, because an annual review alone may miss a vendor receiving a new data feed next week, and at exit revoke access, return or destroy data under applicable terms, recover assets and settle outstanding obligations, verifying completion rather than assuming termination of the invoice ended the risk. For owners, third-party risk management is not about eliminating every vendor but about knowing what a partner can affect, making a proportionate choice, and keeping that choice sound as the relationship changes.