Third-Party Risk Management
Contains best practice policy content, descriptions, and processes your organization can use as the foundation to customize and align to your own third-party risk management framework.
Download Free Template
- Reflects regulatory guidance and best practices in the third-party risk management process
- Policy template is available as a Microsoft Word editable template document, so it's easy to use and reformat to fit your organization
- Includes a complementary instructions PDF and a guide PDF to give you further knowledge as you build out your policy
- Over 19 sections including:
- A statement of purpose through scope
- Oversight through reporting expectations
- Activities through the third-party risk management lifecycle like risk assessment, due diligence, contractual standards, ongoing monitoring, termination, etc.
Preview the text content for this template
1. Overview and Background
(Company) (hereinafter referred to as (Company)) uses Third Parties to provide products or services in support of our business operations. Such outsourced relationships may benefit (Company) by reducing costs, improved performance, staff augmentation, increased business competitiveness, access to specific expertise, and established distribution channels. However, Senior Management and the Board of Directors recognize that (Company’s) reliance on third-party relationships presents many risks that must be identified, assessed, and managed. Failure to manage these risks can expose (Company) to financial loss, litigation, or other damages or may even impair (Company) ability to service existing customer relationships or establish new ones.
2. Statement of Purpose
This policy aims to establish standards and guidance relating to (Company)’s management of its third-party relationships and the associated inherent and residual risks presented by those third-party relationships. These risks are present when (Company) engages with third parties to provide products and services directly to (Company) for the benefit of its internal operations, employees, investors, or customers. Furthermore, the (Company) documents the structure for; identifying, assessing, controlling, monitoring, and reporting on risks related to (Company)’s use of third parties per applicable laws, safe and sound business practices, and related supervisory guidance, particularly that of the Final Interagency Guidance from the Board of Governors, the FDIC, and the OCC.
3. Policy Statement
Relationships with third parties are fundamental to (Company)’s ability to maintain its operations and offer products and services to its employees, customers, and investors. However, (Company)’s use of third parties does not diminish its responsibility to ensure that the activity is performed safely and soundly and complies with applicable law, has established the (Policy Name) (hereinafter referred to as the policy), to formally define the framework, tools, roles, responsibilities, scope, and components, needed for a fully functioning Third-Party Risk Management program. The framework shall comply with all applicable laws and regulatory guidelines. Accordingly, this policy sets forth the requirements for the effective identification, assessment, and management of these risks.
4.1 Third Party
The term third party broadly covers similar terms such as vendor, supplier, providers, and the like. The term third party relates to any person, independent consultant, or form of a legal entity, including but not limited to: vendors, service providers, suppliers, processors, business partners, marketers, or other third parties, with whom (Company) contracts for purposes of obtaining products or services, or who collaborate with (Company) in providing products and services in the marketplace.
4.2 Third-Party Risk Management and Oversight
Third-Party Risk Management is the formalized process of identifying, assessing, and mitigating risks presented to (Company), its employees, investors, and customers due to the improper supervision or mismanagement of the following: data, operations, compliance, and financial condition concerning those external parties with whom (Company) has a relationship. The term Third-Party Risk Management (hereinafter referred to as TPRM), is also inclusive of all reporting, governance, and oversight activities necessary to ensure the safe and sound engagement with (Company)’s third parties.
TPRM applies to all business relationships between a third party and (Company) by contract or otherwise.
All (Company) employees, independent contractors, and consultants are subject to this Policy. As are other entities, engaging third parties for the Company's direct or indirect benefit, third parties with whom they contract.
5.1 Third Parties Not in Scope Under This Policy
The following third-party relationships have been excluded from this Policy.
a) Relationships with Customers
b) Relationships with Investors
c) Relationships with Employees
d) Relationships with public utility providers
e) Relationships with emergency services such as police or fire departments
f) Relationships with government agencies, taxing authorities, regulatory bodies, and courts
5.2 Pre Existing Third-Party Relationships
It is the responsibility of (Company) Senior Management and the Board of Directors to ensure compliance with this Policy regarding third-party relationships maintained by (Company). It is possible that certain existing third-party relationships (and contracts) do not comply with all policy aspects. However, (Company) is obligated to renegotiate, to the extent possible, any contract terms and conditions to existing third-party contracts to comply with this policy and the related processes. Renegotiation shall occur at the first potential and reasonable opportunity (i.e., contract negation.)
6. Third-Party Risk Management Oversight
Senior Management and the Board are ultimately accountable for the TRPM policy, program, and processes' oversight and effectiveness. Senior Management and the Board of Directors ensure that the TPRM program operates according to applicable federal and state laws, rules, regulations, internal policies, and procedures. They achieve this through the following:
6.1 Policy Management and Approval
Senior Management and the Board initially approve and oversee the Third-Party Risk Management and Oversight Policy and annually review and, if necessary, update the Policy.
6.2 Approval of Critical Third Parties
Senior Management and the Board, or their designated committee, are responsible for the decision to approve the addition or termination of third-party relationships considered critical to (Company). Such approvals are mandatory in advance of final contract execution with any material third party.
6.3 Periodic Review of Critical Third Parties
Senior Management and the Board or their designated committee shall periodically review third parties considered critical to (Company)'s operations. They must consider the related risk assessments monitoring, compliance, business continuity, financial health, and overall performance of those material third parties.
6.4 Staffing and Resources
Senior Management shall allocate sufficient qualified staff (internal or augmented) to provide the necessary oversight and monitoring of significant third-party relationships. Sufficient resource capacity is maintained to execute essential TPRM processes effectively, especially those requiring specialized expertise. And to ensure all critical and high-risk rated third-party relationships are assessed, monitored, and managed commensurate with the product or service's risk.
Frequently Asked Questions
- What is a third-party risk management policy?
The policy is the first document that should be created and will identify the roles, responsibilities, regulations, and overall purpose of a program. It also provides a broad outline on the areas of due diligence, risk assessments, contract management, and establishes how the board and senior management will stay informed of vendor management activities.
- Is this template really free?
Yes! We know that this template is valuable (and that many organizations put a price on accessing a template) but, as passionate advocates for better third-party risk management practices, we have decided that there is no better way to assist than by giving third-party risk professionals a helping hand with this customizable template. You still have a lot of work to do to customize and align to your organization, but we are hoping this gets you there faster!
- Does this policy allow me to customize it to match what my organization does?
Absolutely, and, we urge you to do so! The template is formatted in a Microsoft Word document so it’s easy to change any aspect. Instructions point out what specially to edit and a guide gives best practices and tips.
- Who created this template?
This free policy template was carefully crafted by Venminder’s highly skilled third-party risk professionals who have not only done the job in their own careers, but today advise Venminder's 1,200+ customers, many of whom are subject to the strictest regulatory guidance.