Everyone knows that third-party relationships introduce risk. But what about second parties, fourth parties and beyond?
Let’s take a quick look at first, second, third, fourth, and fifth parties to understand who they are and the potential risks they pose.
First Party
This is your institution, and it’s where it all begins. Risk comes in many forms: operational, transaction, financial, credit, strategic, compliance, reputation, concentration, and cyber, among others. Every decision your institution makes has the potential to introduce risk from big picture moves like a change in strategy or a new business line to smaller details like new disclosures.
First-party risk is best handled with enterprise risk management (ERM). ERM is the unified systems, processes, culture, and approach your institution uses to manage risk. It ensures that risk management isn’t a solo activity but one that links your institution’s mission, vision, and values with strategy and decision making to ensure that the amount and types of risk your institution takes on is commensurate with its risk appetite. It makes sure risks are identified, measured, monitored, and mitigated.
Second Party
These are your customers or members. While much of risk management is dedicated to protecting customers and their data, it’s important to remember that customers can pose risks too.
For example, Bank Secrecy Act/Anti-Money Laundering (BSA/AML) rules are designed to weed out customers that use the financial system for nefarious purposes. FinCEN’s new customer due diligence (CDD) rules requiring the establishment of beneficial ownership for business relationships were developed for the same reasons. While most customers are just going about their business, those who use the banking system for criminal activities create extra work and compliance risk.
There’s the risk that customers won’t pay back loans or might sue the institution. Customers also introduce security risks, particularly when it comes to online and mobile banking. Customers may not have the latest security safeguards on devices, making it easier for hackers to gain access to the bank’s systems or impersonate customers.
It’s important to recognize these risks and put safeguards in place to properly manage and mitigate them.
Third Party
When your institution outsources an activity to some other provider, that institution is a third-party provider. This includes everyone from your landscaper to your technology service provider.
Third-Party Vendor Management: Biggest Risks for Your FI
Whether you handle an activity or you outsource it to a third-party vendor, your institution is responsible for the outcome just the same. That means it’s essential to identify critical vendors or high-risk vendors. These are vendors involved in critical activities that could have a major impact on operations such as payments or IT.
Regulators provide detailed guidance on monitoring these relationships, including understanding how the vendor relationship fits into the institution’s overall strategic plan, vendor due diligence, contract negotiation, ongoing monitoring, and termination. Financial institutions are expected to know what vendors are doing, how they are doing it, and what steps they are taking to remain compliant with all laws, regulations, policies and procedures. That makes vendor management an essential element of any ERM system.
Fourth Party
Your institution outsources functions and your vendors probably do too. A fourth-party is someone your vendor outsources to. Fourth-party vendors go by a lot of names. Some companies call them providers. Others call them strategic partners. They can provide bill pay, mobile banking, core processing, legal or other services.
Your institution isn’t just responsible for what your vendor does. It’s also responsible for the activities of its third-party vendors (aka fourth-party vendors).
There are ways to limit fourth-party vendor risk. When considering vendors, ask them about outsourcing and have them provide information on their third-party risk management (TPRM) program. Assessing the strength of a critical or high-risk vendor's TPRM program is a necessary part of due diligence. Don't just take a vendor's word for it. The program should be documented, and you should be informed of any major changes. Follow up and review documentation to ensure the vendor's TPRM program is working as it should.
The Statement on Standards for Attestation Engagements 18 (SSAE 18) is a valuable resource for managing fourth-party risk. The SSAE 18 contains a vendor management element that requires a vendor to define the scope and responsibilities of each third-party vendor it uses, and addresses performance reviews, audits, and monitoring. Third-party vendors that can provide SSAE 18 make fourth party risk management simpler.
Unless a contract specifically prohibits it, a vendor can transfer its rights and responsibilities to another vendor. Your contracts should require an assignment clause that provides notice and consent before a vendor outsources—giving you the ability to control fourth-party risk.
Fifth Party
This is where things can get extra convoluted. When your vendor’s vendor outsources, this is a fifth-party. (It doesn’t necessarily even stop here as that vendor can outsource to yet another vendor creating a sixth, seventh, eighth-party and beyond.)
Once again, your institution is responsible for the actions these vendors take on your behalf. The best assurance is assessing your third-party vendor's vendor management program. If your vendor has a strong TPRM program, it will also assess its vendors' TPRM program, giving you assurance down the line.
Now that you understand all the parties involved, make sure you have systems in place to manage the risks they present. With so many parties to track, don’t use a casual approach to management. It’s too risky.
Subscribe to the Nsight Blog
Share this
Vendor Risk Management
NCUA Eyes Economic Environment, Change Management & Third-Party Risk With 2019 Supervisory Priorities
