Third-party vendors continue to be an integral part of today’s financial services industry as they help financial institutions (FIs) of all sizes reach their goals. However, without both parties committed to maintaining business continuity, poor vendor relationships can damage an FI’s operations, compliance posture, reputation, finances, and consumer relationships.
Third-party risk management (TPRM) is also an increasingly important topic to regulators, including the Office of the Comptroller of the Currency (OCC), Federal Deposit Insurance Corporation (FDIC), and the Federal Reserve, as they released new vendor management requirements in June 2023. According to the interagency guidance, “Whether activities are performed internally or via a third party, banking organizations are required to operate safely and soundly and in compliance with applicable laws and regulations.”
In other words, the vendor’s risk is your institution’s risk.
So, how can FIs ensure their vendor relationships are compliant and productive? What red flags should your FI consider as you navigate third-party relationships? How can you address red flags before they cause further damage?
Let’s discuss.
Related: How to Avoid Common Third-Party Risk Management Mistakes
While every vendor relationship will look a little different based on your institution’s needs, there are some red flags FIs should be aware of as they engage in TPRM.
The most glaring business continuity red flag occurs when a vendor is unwilling to provide information about its business continuity plan and disaster recovery plan for critical systems or processes. This red flag extends to every area of the vendor relationship, from communications to document sharing. For example, suppose a vendor is reluctant to share information about how it backs up critical systems your FI uses. Why is it hesitating? Is it possible it’s hiding a deficiency? Or perhaps the vendor says the information is private or proprietary. A contract typically includes a non-disclosure, so claiming it is proprietary information that can’t be shared is not an excuse. In this case, there’s a high chance that they’re hiding other items or issues that could harm both organizations and their customers.
Conversely, vendors that readily share information typically stay current in their security practices and have resilient systems that can withstand interruptions to business operations or incidents, such as a data breach or power outage. For instance, if your vendor mentions that it has made significant investments in a failover solution (i.e. a backup system or component that activates when the primary system fails), it wants your financial institution to recognize it is committed to protecting your data and the relationship. This also demonstrates that it is taking its compliance responsibilities seriously.
Besides lacking communication, a vendor may be tentative to share essential documents. Examples of documents your FI may need to request from vendors include:
These are just a few of the items you may need to request. If your vendor is reluctant to hand over these documents, it may signal broader TPRM issues.
Related: Expert Q&A: How to Assess Vendor’s Data Recovery Capabilities
To provide system recovery test results, vendors must conduct regular system recovery testing to understand how efficiently they can recover from potential failures. Some examples of metrics FI should have access to include:
If a vendor does not readily provide test results or relies on outdated recovery reports, it may be concealing potential weaknesses or problems in its operations.
However, it’s common for vendors to encounter challenges during testing. If your vendor shares its test results, including what worked, the issues it faced, and plans for resolution, it indicates that it takes business continuity seriously—this is a positive sign.
Related: Business Continuity Planning vs. Disaster Recovery: Understanding the Difference
Your FI isn't only responsible for what your vendor does; it's also responsible for the activities of its third-party vendors (aka fourth-party vendors).
A fourth party is an organization to which your vendor outsources part of your contracted services, whether related to infrastructure, servers, systems, mobile banking, bill payments, legal services, or another area. For example, your vendor might use Amazon Web Services (AWS) or Microsoft Azure for cloud services. In that case, the cloud service is the fourth party.
But the vendor circle may not stop there. The fourth party may outsource to another vendor, creating a fifth party. This trend continues with sixth, seventh, and eighth parties and beyond, emphasizing the need for ongoing vigilance in managing vendor relationships.
Regardless of the level, FIs must ensure they understand the additional layers of risk that these relationships pose. It's crucial to proactively evaluate how that risk affects your third-party management strategies. One helpful resource for evaluating fourth-party vendors is the Statement on Standards for Attestation Engagements 18 (SSAE 18), which FIs can use to evaluate the security and reliability of those services.
Related: First, Second, Third, Fourth and Fifth Parties: How to Measure the Tiers of Risk
Do you have long-term relationships with any vendors? It’s not unusual for FIs to work with the same vendor for 5, 7, 10, or even 20 years. But while a relationship can start on the right track, inconsistencies in communication are one of the first signs of hazards ahead.
Communication problems are especially common with inexperienced vendors. They may not communicate their processes and policies effectively, potentially creating misunderstandings and leaving its clients (i.e. your institution) unprepared for risks and changes in service.
There are instances when vendors will reasonably not share information with an FI.
If the requested information involves proprietary technology and trade secrets that could compromise the vendor’s competitive advantage, it’s reasonable for them to withhold such details. For example, a bank or credit union doesn’t need to know the specific products and proprietary details about systems, technologies, and solutions, such as active-active environments and recovery metrics. The vendor just needs to confirm they have an active-active setup and provide the detailed recovery time (MTD, RTO and RPO) values.
Whether a vendor relationship is new or existing, there are ways FIs can address current or potential issues:
Resolution starts with an honest conversation. Voice your concerns to the vendor. Be clear about the issues your organization has faced, the consequences for the vendor and your organization, and your commitment to addressing the issues.
Once the conversation has been initiated, it’s important to establish contract updates to ensure the red flags are addressed. Some potential contract addendums may require the vendor to share test results and recovery times on a set schedule or to share protocols for addressing ransomware and other threats.
While you can do everything on your end to address red flags and repair a vendor relationship, there’s a possibility that that vendor will fail to communicate or address the issues. In these cases, reach out to peers for insights, especially if they have the same vendor, or consider escalating the issue to higher leadership.
Keep in mind that the saying "out of sight, out of mind" does not apply to third-party risk management. Stay alert while working with vendors. If you notice any red flags, make a note of them, communicate your concerns, and take appropriate action. Even if an issue seems minor, remember that a vendor's risk can also affect you.
What should you look for in a business continuity solution?
Find out in our Business Continuity Buyer’s Guide.