These requirements throw up some daunting challenges, and the sheer volume of third parties serving many organisations will make it difficult to keep track of them all and conduct thorough due diligence on each one. Every third party must be managed, and strong relationships are needed to effectively manage risks, especially if detailed visibility into their operations is needed, or when third parties are located in different countries with different risk cultures and regulatory frameworks.
Despite the challenges, a strong TPRM programme is essential to protect against risks such as financial losses, operational disruptions, and reputational damage, which can arise from third-party failure.
There are four essential areas that financial institutions must prioritise to implement an effective TPRM practice:
- Reviewing and reporting ICT third-party risks
Maintaining a comprehensive register of risks is essential, not only to serve as a central repository of information but also to help categorise and prioritise risks based on their potential impact on the organisation. Regulators mandate the reporting of new ICT services at least annually, to foster transparency and allow them to gain insight into the risk exposure of the institution.
When onboarding a third party, organisations need to understand both the inherent risks (those existing before any mitigating actions) and the residual risks (those remaining even after precautions have been taken). These must be aligned with the wider enterprise risk strategy and risk appetite.
- Establishing minimum contractual provisions and exit strategies
The heart of effective TPRM lies in establishing minimum contractual provisions for ICT services provided by third parties. These should outline the expectations, responsibilities, and liabilities of both parties, reducing ambiguity and ensuring a clear understanding of the engagement.
Well-defined exit strategies need to be included in contracts. In the event of termination, the exit strategy will determine the steps needed to transition to an alternative solution without compromising the organisation's operations or data security.
PRA regulation also advises firms to test exit strategies and stressed exits. This is becoming a focus area for many firms if not already covered in their existing TPRM framework.
- Monitoring and mitigating concentration risk
Concentration risk, a significant concern in TPRM, refers to over-reliance on a single third-party vendor for the delivery of a materially important business service. If a critical vendor encounters financial instability, security breaches, or operational disruptions, it could lead to severe repercussions for a financial institution.
Monitoring and mitigating concentration risk involves not only diversifying the portfolio of third-party vendors but also understanding the dependencies within the vendor's own supply chain. These can be addressed by including questions about their supply chain resilience framework when conducting Business Continuity due diligence checks, and ensuring their response is in line with the organisation’s risk appetite. Sub-outsourcing, where a vendor further delegates tasks to its own third parties, should be monitored to prevent concentration risks from trickling down the chain.
- Standard contractual clauses for cloud computing
As cloud computing gains prevalence due to its scalability and efficiency, its associated risks cannot be ignored. To address these concerns, standard contractual clauses (SCCs) have been developed. While these clauses are voluntary, they provide an accessible and structured framework for managing risks related to cloud services. Implementing SCCs helps in maintaining consistency and alignment with regulatory expectations. They cover aspects including data protection, data ownership, access controls, and data breach notifications, ensuring a well-rounded approach to cloud-related risks.
As the digital world becomes increasingly interconnected, financial institutions that prioritise TPRM will not only safeguard their operations and reputation but also ensure they remain compliant with regulatory standards.
At BeyondFS, we specialise in helping financial institutions effectively address new regulatory requirements, including the Digital Operational Resilience Act (DORA) and its Third-Party Risk Management (TPRM) provisions. We can help organisations:
- Establish a robust TPRM operating model: defining and implementing a target state operating model, ensuring alignment with regulatory expectations and industry best practices.
- Validate regulatory adherence: thorough assurance that TPRM processes and third-party due diligence measures align with DORA's stringent requirements.
- Identify and remediate TPRM gaps: in-depth assessments to pinpoint any gaps or deficiencies in the TPRM framework, and supporting proactive remediation measures.
- Integrate TPRM with risk strategy: integrate TPRM into overall risk management strategy, ensuring that risk appetite is adequately addressed throughout third-party relationships.
- Establish a centralised third-party data repository: creating a comprehensive repository for third-party data as a centralised hub for effective risk management.
We recommend a brief introductory call or participation in one of our Operational Resilience roundtables, which will provide you with an insight into our approach and how we can tailor our solutions to your specific needs.
