Third-Party and Vendor Risk Management
Lifecycle and tiering
The third-party lifecycle runs from planning and due diligence through contracting, onboarding, ongoing monitoring, and termination/exit. Risk-based tiering determines the depth of diligence and monitoring: critical or high-risk vendors (data access, operational dependency, regulated activity) receive more scrutiny than low-risk suppliers. A common trap is applying uniform diligence to all vendors, or treating a vendor as low risk simply because the spend is small - risk follows data and operational dependency, not contract value.
Due diligence and contracting
Diligence should cover financial stability, security posture, compliance history, subcontractors (fourth parties), and business continuity. Contracts must address service levels, audit rights, data protection, breach notification, subcontracting, termination assistance, and liability. Candidates should know that outsourcing does not outsource regulatory accountability - the regulated entity remains responsible for the activity.
Ongoing monitoring and concentration risk
Monitoring includes performance against SLAs, periodic reassessment, attestations (e.g., independent control reports), and continuous intelligence. Concentration risk arises when many critical functions depend on one vendor or a small cluster; exit and substitutability planning mitigate it. Fourth-party risk (the vendor's own suppliers) is frequently overlooked.
Worked example
A small marketing vendor gains access to customer data. Despite low spend, the data access makes it high risk, requiring security diligence, contractual data-protection clauses, and annual reassessment. Rule of thumb: tier by access and dependency, not by contract value, and always ask who the fourth parties are.