It's no secret that for many organizations, the time and resources for third-party vendor relationship management are stretched thin. This is especially true when third-party vendor inventory numbers are in the hundreds or even thousands, so it’s best to determine which of your vendors (or other third parties) can be safely excluded from third-party risk management (TPRM) activities.
However, it may not always be obvious which of these relationships should be in or out of scope. The good news is that organizations can use some tried and true guidelines to determine what type of third parties can be out of scope for TPRM. Read on to learn more and help ease the burden of your TPRM responsibilities.
Those in regulated industries know they must meet the requirements of established TPRM guidance, such as the Interagency Guidance on Third-Party Relationships: Risk Management. This guidance became effective in June 2023 and dramatically expanded the definition of a third party to "any business arrangement between a banking organization and another entity, by contract or otherwise."
Under this guidance, entities such as professional service providers, maintenance and custodial service companies, independent consultants, and cloud computing services would be considered in scope for TPRM. However, the guidance also states that not all third-party relationships will require the same level of oversight and risk management.
While this guidance is specific to the financial industry, those regulations greatly influence and shape all TPRM best practices. It’s important to develop a sound (and defensible) methodology to define why certain third-party relationships are out of scope for your TPRM activities.
Although many organizations must now expand their scope of third-party relationships, this may not extend to all oversight and risk management activities. There may still be circumstances in which certain third parties can be exempt from following each activity within the TPRM lifecycle.
To determine exempt or out of scope third parties from the TPRM lifecycle, the first step is to prepare a complete list of all individuals or organizations that are paid by or have a written agreement with your organization. Your accounts payable department should be able to furnish much of this information. It’s essential to include the product/service provided or the other nature of the relationship as part of the list. Truthfully, this can be a time-consuming, but necessary process.
Once your list is complete, you can use the following questions as a starting point to help determine whether a third-party vendor should be in scope or out of scope for your organization:
Many of these exempt or out of scope third-party vendors share some common characteristics, which make them less relevant to include in your TPRM activities.
Example: Your organization may have little or no choice in engaging with some of these third-party vendors, which would exclude them from the third-party selection process. Similarly, a third-party relationship with a government entity would not undergo any type of formal risk assessment, due diligence, contracting, or monitoring. Some of the previous third-party relationships might also be considered transactional, in which the third party's product or service is purchased once or sold “as-is” and wouldn’t be subject to oversight activities or ongoing monitoring.
If you choose to exclude the third-party vendors above from your third-party risk management program activities, and deem them out of scope, proceed with caution for the following reason:
There is at least some risk with any third-party relationship and not every organization is as it appears. For example, small, cash-based businesses may be vulnerable to certain risks, including money laundering, health and safety violations, and even human trafficking.
Example: Suppose you aren't evaluating the risk associated with buying hardware because it’s a one-time purchase. In that case, you may be missing something important, such as the hardware manufacturer purchases components from China’s Xinjiang Uyghur Autonomous Region (XUAR), which is forbidden under the Uyghur Forced Labor Prevention Act due to known human rights violations in this area.
It’s important to recognize that all third-party relationships carry some risk, and your TPRM efforts and activities should always demonstrate this principle. To ensure the risk of each third-party engagement is identified and understood, it’s recommended that at a minimum you complete an inherent risk assessment. The results of the risk assessment can help you determine what will be necessary to manage that relationship safely and soundly.
Your organization may determine that other third-party or vendor types should be out of scope, and that’s okay. But always make sure that you can articulate and document your rationale for any out of scope decision.
Even though the Interagency Guidance on Third-Party Relationships has broadened the definition of a third-party relationship, the same guidance also emphasizes the importance of taking a risk-based approach when managing those relationships. Not every relationship will require the same risk management activities.
It’s important to remember that regulators expect that you can articulate and defend your methodology for determining what TPRM activities will be applied to each relationship.
Determining which third parties will be in or out of scope is crucial for optimizing your third-party or vendor risk management program. It will allow you to direct your efforts toward third-party relationships that deserve your focus and resources.