Building a third-party risk management program is how a financial institution turns that sprawling dependency map into something it can govern. Outsourcing an activity does not outsource the responsibility for it, a point banking agencies have made repeatedly in guidance and enforcement actions.
This guide walks through building a program step by step: what regulators expect, how to inventory and tier your third parties, how to scope due diligence, what belongs in the policy, and how to monitor and govern the program once it runs.
What Regulators Expect: The 2023 Interagency Guidance
The anchor publication is the Interagency Guidance on Third-Party Relationships: Risk Management, issued in June 2023 by the Federal Reserve, FDIC, and OCC. Three principles from the guidance shape everything that follows:
Risk-based proportionality
The agencies do not expect identical oversight for every vendor. Oversight should be commensurate with the risk and criticality of each relationship.
Life cycle coverage
The guidance organizes risk management around five stages: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination.
Board and management accountability
The board is responsible for oversight of third-party risk while management is responsible for running the program.
For community institutions, the agencies followed up with the 2024 third-party risk management guide for community banks, acknowledging that smaller institutions need proportionate paths to the same outcomes.
Step 1: Inventory Your Third Parties and Tier Them by Risk
The first build step is a complete inventory: every vendor, partner, and service arrangement, including the ones that bypassed procurement. With the inventory built, run a third-party risk assessment on each relationship to assign a tier.
Two concepts drive the tiering:
- Inherent risk is the risk the relationship carries before any controls: what data does the vendor touch, does it face your customers, could its failure interrupt critical operations?
- Residual risk is what remains after controls are applied
Tier on inherent risk, because tiering decides how much scrutiny the relationship gets; let residual risk inform ongoing decisions.
Step 2: Conduct Risk-Based Due Diligence
The due diligence scope follows the tier. For critical third parties, the guidance points to a broad review:
- Financial condition
- Information security practices
- Business continuity and resilience
- Compliance management
- Subcontractor reliance
- Operational capacity
For low-tier vendors, a streamlined checklist is defensible, and documenting why the lighter scope is appropriate is part of the discipline.
Step 3: Write the Policy and Contract Standards
A workable policy defines:
- Scope (what counts as a third-party relationship)
- Tiering methodology
- Due diligence requirements by tier
- Contract standards
- Monitoring cadence
- Escalation paths
- Roles
Keep it short enough that business lines follow it and put the procedural detail in standards documents underneath it. The program should document where standard provisions were unattainable and what compensating monitoring fills the gap.
Step 4: Monitor Continuously and Manage Issues
Ongoing monitoring is where most programs are weakest, and where examiners increasingly focus. Recent third-party risk management statistics underline this. Quarterly or continuous review fits critical vendors while annual review fits low tiers.
The table below summarizes the five lifecycle stages of a third-party risk management program and who typically owns each.
| Lifecycle Stage | Objective | Key Activities | Typical Owner |
|---|---|---|---|
| Planning | Decide whether and how to engage | Risk assessment of the proposed activity, strategic fit, exit options | Business line with risk input |
| Due diligence & selection | Verify the third party can perform safely | Financial, security, compliance, and resilience review scoped by tier | Vendor risk team + subject experts |
| Contract negotiation | Lock obligations into enforceable terms | Performance measures, audit rights, breach notification, termination provisions | Legal with business line |
| Ongoing monitoring | Detect deterioration before it becomes disruption | KRI tracking, SLA review, periodic reassessment, issue management | Vendor risk team + relationship owner |
| Termination | Exit without disruption or data loss | Transition planning, data return and destruction, access revocation | Business line with vendor risk oversight |
Tie monitoring outputs to an issue management process with:
- Severity ratings
- Owners
- Deadlines
- Escalation
Step 5: Govern, Measure, and Mature the Program
Governance means a defined structure, typically:
- A vendor risk function in the second line
- Business-line relationship owners in the first line
- Audit testing the program in the third line
Board reporting should cover the:
- Critical vendor population
- Concentration risks
- Material issues
- Program health metrics
Technology helps at every stage. Platforms such as Predict360 provide a centralized third-party data repository, configurable onboarding and due diligence checklists, vendor risk categorization, and embedded reporting within the same system that holds the institution’s broader risk and compliance records.
Frequently Asked Questions
Which regulatory publication addresses third party risk management for banks?
The Interagency Guidance on Third-Party Relationships: Risk Management, issued in June 2023 by the Federal Reserve, FDIC, and OCC, is the primary publication for U.S. banks. It replaced the agencies’ earlier separate guidance and applies a risk-based, life-cycle approach to all banking organizations.
What are the four core third party risk types?
Operational, compliance, strategic, and reputational risk are the four core categories. Operational risk covers service disruption from vendor failure, compliance risk covers regulatory violations caused by a third party, strategic risk arises when relationships undermine business objectives, and reputational risk attaches a vendor’s failures to the institution’s name.
What is the difference between TPRM and vendor risk management?
Vendor risk management traditionally covers contracted suppliers. Third-party risk management is broader and includes vendors plus fintech partnerships, referral arrangements, joint ventures, and other business relationships that may not involve a purchase contract.
The strongest next step is to read the guidance itself alongside your current vendor inventory and note where the gaps are. From there, it is worth understanding how AI is changing third-party risk management.
Discover AI-powered technology that helps manage every aspect of risk and compliance, all in one platform.
Request Demo- Risk Prediction
- Regulatory Tracking
- Workflow Automation
- Integrated GRC