After the housing crisis, Fannie Mae, Freddie Mac and the Federal Home Loan Banks were largely focused on credit and market risk. Now with an increasing awareness of cybersecurity, IT security, data, and operational risk, oversight of third-party providers has become increasingly important.
So important, in fact, that the Federal Housing Finance Agency (FHFA) issued new guidance, "Oversight of Third-Party Provider Relationships" for Fannie, Freddie, the FHLBanks, and the Office of Finance (OF).
The FHFA defines a third-party provider relationship as “a business arrangement between a regulated entity and another entity that provides a product or a service.”
It doesn’t apply “when a FHLBank provides products or services to its members or housing associates.”
The guidance is basically a “greatest hits” album of third-party risk management guidance from the agencies, including the Federal Reserve, Office of the Comptroller of the Currency and the FDIC. The agency almost could have cut and pasted it. It features all of your favorites from the third-party risk management life cycle including:
It also highlights key elements including:
The guidance notes that the degree of risk management, including due diligence, should correspond to the level of risk and the complexity of the relationship. It also says that third-party relationship management should be a part of a regulated entity’s overall enterprise risk management (ERM) program.
If I’ve said it before, I’ll say it again. Third-party vendor management touches nearly every area of an institution. Don’t believe me? Look at the list of related FHFA guidance on the subject:
Increased attention on third-party relationships isn’t likely to end anytime soon. Vendor management isn’t a fad. It’s an increasingly important area, one that links guidance on everything from cloud computing, data and information technology to operational risk management, oversight of vendor relationships, and internal audit and governance.
If you’ve been holding off on formalizing your approach to vendor management, this is another sign that you need to get on board.