Third party risk management (TPRM) is how a company finds, measures and controls the risks that come from working with outside organizations. Those outside organizations include vendors, suppliers, consultants, partners and even the vendors your vendors use. The risks can be about security, money, law, operations or reputation.
This guide explains TPRM in plain terms for a company that buys services, not only for banks. It uses the five stage life cycle from the 2023 guidance issued by US bank regulators, because that model is clear, public and widely copied. It ends with a simple tiering method and a checklist for each stage.
TPRM, vendor risk and supply chain risk
These terms overlap. Here is how they relate:
| Term | Scope |
|---|---|
| Third party risk management (TPRM) | The umbrella: all outside relationships, including vendors, partners, affiliates and fourth parties |
| Vendor risk management (VRM) | A subset of TPRM for companies that sell you a product or service |
| Supply chain risk management (SCRM) | Risks in the flow of goods, materials and services |
| Third party cyber risk management | The security and data side of TPRM |
All vendors are third parties, but not all third parties are vendors. A referral partner or joint venture is a third party even if it sells you nothing.
Sources: ProcessUnity, "What Is Third-Party Risk Management: The 3 Types of TPRM"; DPO Consulting, "How TPRM Relates to Vendor Risk Management and Supply Chain Risk Management"
The 2023 interagency guidance
On June 9, 2023, three US bank regulators published final guidance on managing risks from third party relationships. They were the Federal Reserve Board, the Federal Deposit Insurance Corporation (FDIC) and the Office of the Comptroller of the Currency (OCC). The guidance replaced each agency's earlier general guidance on the topic.
Three ideas from it are useful for any company:
- A relationship can exist without a contract. The guidance says a third party relationship may exist even without a contract or payment. Examples it lists include outsourced services, independent consultants, referral arrangements and joint ventures.
- Effort should match risk. Sound TPRM takes into account the level of risk, complexity and size of the organization, and the nature of each relationship.
- Risk runs through a life cycle. Risk management covers every stage of the relationship, not only the day you sign.
The guidance is written for banks. If you are not a bank, it is not a rule for you, but its structure is a good starting model.
Sources: Board of Governors of the Federal Reserve System, FDIC and OCC, "Interagency Guidance on Third-Party Relationships: Risk Management," 88 FR 37920 (June 9, 2023)
The five stages of the third party life cycle
The guidance names five stages. Here is each one in plain terms, with what a typical company buying services would do.
1. Planning
Before you look for a vendor, decide what the activity is, what could go wrong and how much it matters. Ask: what data will the vendor touch? What happens if they fail? Do we have the staff to oversee them?
2. Due diligence and third party selection
Check the vendor before you commit. The guidance lists areas such as financial condition, business experience, legal and regulatory compliance, information security, reliance on subcontractors and insurance coverage. For a software vendor, ask for its SOC 2 report. The guidance notes that a reviewer should consider whether the scope and results of such reports fit the activity the vendor will perform.
3. Contract negotiation
Write your protections into the contract. Key terms include service standards, data protection, incident notice, subcontracting rules, what counts as default, and how the contract can end. The guidance also points to the timely return or destruction of your data at the end. A master service agreement usually holds these, with a service level agreement for measurable targets.
4. Ongoing monitoring
Keep checking after the contract starts. Review performance against the SLA, request updated audit reports, watch for news about the vendor, and reassess when the relationship changes.
5. Termination
Plan the exit before you need it. Decide how data will be returned or destroyed, how access will be removed and how the service will move to a new provider. Make sure every obligation is met before the relationship ends.
Sources: Federal Reserve, FDIC and OCC, Interagency Guidance, section C, "Third-Party Relationship Life Cycle"; ProcessUnity, "What is the Third-Party Risk Management Life Cycle?"
Governance: who owns TPRM
The guidance also sets out three governance duties: oversight and accountability, independent reviews, and documentation and reporting.
In practice, ownership is shared:
| Role | Typical duty |
|---|---|
| Risk or compliance office | Owns the program and the policy |
| Security team | Reviews security controls and audit reports |
| Procurement | Runs onboarding and vendor selection |
| Legal | Negotiates contract protections |
| Business owner | Owns the day to day relationship and its risks |
Senior oversight often sits with a chief risk officer or chief information security officer. Whoever owns it, write down who does what.
Sources: Federal Reserve, FDIC and OCC, Interagency Guidance, section D, "Governance"; DPO Consulting, "Who Owns TPRM in an Organization?"
A simple way to tier vendors
You cannot review every vendor in depth. Tiering puts the most effort where the risk is highest. Here is a simple three tier model to adapt.
| Tier | Typical example | Checks before signing | Review cycle |
|---|---|---|---|
| High | Holds sensitive customer data, or the business stops if it fails | Full due diligence, SOC 2 Type 2 or similar, contract review by legal | At least yearly |
| Medium | Has limited data access, or could be replaced in weeks | Security questionnaire, references, standard contract | Every one to two years |
| Low | No data access, easy to replace | Basic company and payment checks | At renewal |
Score each vendor on two questions: how bad would a failure be, and how likely is it? Those are the same factors many TPRM programs use to rank risk. This tier table is our own example, not a rule from any regulator.
Sources: ProcessUnity, "Scoring the Risk"; Federal Reserve, FDIC and OCC, Interagency Guidance, overview on risk based practices. The tier table is an illustration.
Supply chain risk and NIST SP 800-161
For technology products, supply chain risk is a large part of TPRM. The US National Institute of Standards and Technology (NIST) publishes SP 800-161 Revision 1, "Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations." It was first published in May 2022 and updated as of November 1, 2024. It replaced the 2015 edition.
The guide addresses risks from products and services that may contain malicious functions, be counterfeit, or be weak because of poor manufacturing and development practices in the supply chain. It is free to download and is a useful reference if you buy software or hardware at scale.
Sources: NIST, SP 800-161 Rev. 1 (updated November 1, 2024); NIST, SP 800-161 Rev. 1 (May 2022) record page
A checklist for each stage
| Stage | Questions to answer |
|---|---|
| Planning | What will this vendor do? What data will it touch? What if it fails? |
| Due diligence | Is it stable? Is it secure? Do its references hold up? |
| Contract | Do we have incident notice, service targets, subcontractor rules and an exit plan? |
| Monitoring | Is it meeting the SLA? Is its audit report current? Has anything changed? |
| Termination | Is our data back or destroyed? Is access removed? |
If you are choosing a new vendor, this work sits inside your sourcing process. See the RFP process, and count the cost of oversight in your total cost of ownership.
Sources: Federal Reserve, FDIC and OCC, Interagency Guidance, section C; ProcessUnity, "How to Establish a Third-Party Risk Management Program"
Frequently asked questions
What is third party risk management?
Third party risk management is the process of finding, measuring and controlling the risks that come from working with outside organizations. It covers vendors, suppliers, partners and other third parties across the whole relationship.
What is the difference between TPRM and vendor risk management?
Vendor risk management is a part of TPRM. It covers companies that sell you products or services, while TPRM covers every outside relationship, including partners and affiliates.
What are the stages of the third party risk management life cycle?
The 2023 interagency guidance names five stages: planning, due diligence and third party selection, contract negotiation, ongoing monitoring, and termination.
Who is responsible for third party risk management?
Ownership is usually shared. A risk or compliance office often owns the program, while procurement, legal, security and business owners each handle part of the work.
What is vendor due diligence?
Vendor due diligence is the check you run on a vendor before you sign. It often covers financial condition, business experience, legal compliance, information security and insurance coverage.
Does the interagency guidance apply to companies that are not banks?
No. The guidance is directed at banking organizations supervised by the Federal Reserve, FDIC and OCC, but other companies often borrow its life cycle model.
Sources
- Board of Governors of the Federal Reserve System, FDIC and OCC, "Interagency Guidance on Third-Party Relationships: Risk Management," 88 FR 37920 (June 9, 2023). federalregister.gov
- NIST, SP 800-161 Rev. 1, "Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations." csrc.nist.gov
- ProcessUnity, "What Is Third-Party Risk Management: The 3 Types of TPRM." processunity.com
- DPO Consulting, "Third-Party Risk Management (TPRM): A Complete Guide." dpo-consulting.com