What is third-party risk management (vendor risk management)?
By Nick Jang, founder of MINERVA Studio ·
The short answer
Third-party risk management (TPRM) is the work of finding, assessing, contracting, monitoring and, when needed, exiting the outside parties an organization relies on, so that a supplier’s failure, breach or misconduct does not become the organization’s own. Vendor risk management is the same discipline applied to vendors. In Canadian banking it is governed by OSFI Guideline B-10, in effect since 1 May 2024.
TPRM, vendor risk management and supplier risk: the terms
The three terms overlap. Vendor risk management usually means suppliers you pay for goods or services. Supplier risk management is the procurement world’s name for much the same thing, with more weight on supply continuity and cost. Third-party risk management is the widest: any outside party you have an arrangement with, including partners, affiliates, brokers, cloud providers and financial market infrastructures. OSFI’s B-10 uses the widest definition on purpose.
Why third-party risk management matters
You can outsource a service. You can’t outsource the blame. When a cloud provider goes down, a payroll processor gets breached or a collection agency mistreats customers, both the customers and the regulator look at the company that picked them. Supply chains have also got deeper: your vendor depends on its own vendors (your fourth parties), and a handful of cloud and AI providers sit underneath thousands of products. That creates concentration risk across whole industries.
The third-party risk management lifecycle
| Stage | What happens |
|---|---|
| Planning and sourcing | Decide whether to use a third party at all and what the arrangement needs to deliver. |
| Risk and criticality assessment | Rate the inherent risk (data, money, customers, regulation) and how critical the service is to operations. |
| Due diligence | Check the supplier’s financial health, security, controls, subcontractors, compliance and, for AI, its models and data use, to a depth set by the rating. |
| Contracting | Put rights and obligations in writing: service levels, data protection, audit rights, incident notice, subcontracting, termination and exit. |
| Onboarding | Set up access, integration and the monitoring the contract allows. |
| Ongoing monitoring | Track performance, incidents, changes and financial health; reassess on a cycle and after material changes. |
| Exit and termination | Leave in an orderly way, planned in advance for critical arrangements, with data returned or destroyed. |
What a vendor risk assessment includes
A vendor risk assessment answers two questions: how much could this supplier hurt us, and how well does it control that? The usual inputs are a questionnaire, the supplier’s certifications and audit reports (such as a SOC 2 report or ISO/IEC 27001 certificate), financial statements, security testing results, the contract, and internal facts such as what data the supplier will hold. The output is a risk rating, a list of gaps with owners, and a reassessment date.
A certificate is evidence about the supplier’s controls, not a conclusion about your risk. Read what the report covers and when, and what it leaves out.
TPRM in Canadian banking: OSFI B-10
For federally regulated financial institutions, Guideline B-10 sets the bar: the institution is accountable for all third-party risk; every arrangement is assessed for risk and criticality; due diligence, contracts and monitoring scale with that; high-risk and critical arrangements need specific contract provisions, contingency plans and exit plans; and concentration, subcontracting and cloud are named concerns. E-21 adds that critical third parties must be mapped to the critical operations they support.
AI vendors: the newest third-party risk
AI suppliers raise questions a standard questionnaire misses: which model sits behind the product, who provides it, whether the supplier can change it without notice, where prompts and customer data go, and whether the product makes decisions that make it a model under E-23. Our guides to third-party AI, AI vendor risk under B-10 and AI procurement go through them. MINERVA keeps each AI supplier on the same record as the models and agents that depend on it, from due diligence to exit; see AI vendor risk software.
Related questions
What is the difference between TPRM and vendor risk management?
Vendor risk management covers suppliers you buy from. TPRM covers every outside party you have an arrangement with, including partners, affiliates and infrastructure providers. OSFI B-10 uses the TPRM scope.
What are fourth parties?
Your suppliers’ suppliers. B-10 asks institutions to understand and manage subcontracting risk, especially for critical arrangements.
What is concentration risk in TPRM?
The risk of relying too much on one supplier or geography, inside one organization or across an industry that shares the same provider.
How often should vendors be reassessed?
On a cycle set by their risk and criticality, often yearly for critical suppliers, and after any material change such as an acquisition, a breach or a new service.
Is third-party risk management a good career?
Demand has grown with cloud, AI and new rules such as OSFI B-10 and the EU’s DORA. The work combines risk assessment, contracts, security and vendor relationships.
Sources
- OSFI — Third-Party Risk Management Guideline (B-10)
- OSFI — Operational Risk Management and Resilience, Guideline E-21
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.