Third party risk management

Third party cannot continuously maintain its services due to business disruption. This can lead to the disruption of critical processes, potential impact to client services, and/or loss of revenue.

Client becomes reliant on a single third party to provide multiple critical services or provide multiple products. Multiple third parties provide critical services from a single geography.

Third party personnel, products, services, or systems are not consistent with the client’s agreed service levels, price points, applicable laws, regulations, policies, and procedures and/or ethical standards. This may lead to poor quality in product or services delivery and reputational damage.

Third party has insufficient experience or controls to protect the client’s and its customer's information from unauthorized access, disclosure, modification, or destruction. This can result in a breach or loss of confidential client or company data, reputational damage, and/or potential loss of customers.

Critical third party is not financially secure to provide client services at acceptable levels, leading to a disruption of critical processes, potential impact to client services, and/or loss of revenue.

Third party products or services are impacted because of political changes or instability in a country causing service or product disruption to the third party, ultimately leading to disruption of critical processes and/or loss of customers and revenue.

Third party does not have an adequate risk program to ensure it remains compliant with laws and regulations. Third party does not possess the expertise or adequate controls to meet regulatory guidelines. This can result in enforcement actions being taken (business restriction/fines) and lawsuits.

Third party lacks the proper security to prevent unauthorized access to its facilities, equipment and resources. As a result, a breach or loss of confidential client or company data and/or reputational damage is at risk.

Third party does not maintain a strong cybersecurity control environment, which could have operational, compliance and reputational impacts.

An nth party contracted by the third party to service the client poses an additional risk for meeting its contractual requirements. This can cause disruption of critical processes and a breach or loss of confidential client or company data.