Third-Party Risk Assessment Summaries

Overview

Generate comprehensive third-party risk assessment summaries aligned with OCC Bulletin 2023-17 (Third-Party Relationships: Risk Management Guidance), Federal Reserve SR 13-19, and FFIEC IT Examination Handbook. This skill supports the full third-party risk management lifecycle: planning, due diligence, contract negotiation support, ongoing monitoring, and termination assessment.

When to Use

• Conducting initial due diligence on prospective third-party vendors
• Preparing periodic risk assessments for existing third-party relationships
• Evaluating whether a third-party relationship is critical per OCC 2023-17 criteria
• Analyzing concentration risk across the third-party portfolio
• Preparing board or committee reporting on third-party risk exposure
• Responding to regulatory findings on third-party risk management practices
• Assessing fourth-party (subcontractor) risk exposure through critical vendors

Required Inputs

• Vendor profile: Name, services provided, contract terms, relationship tenure, financial data
• Criticality assessment: Business impact analysis, substitutability, customer data exposure
• Due diligence materials: SOC reports, financial statements, BCP documentation, information security assessments
• Performance data: SLA metrics, incident history, complaint volumes, audit findings
• Regulatory context: Applicable regulations, prior examination findings, consent orders
• Contract terms: Key provisions including termination rights, data handling, subcontracting

Methodology

Step 1: Criticality Determination

Classify the third-party relationship per OCC 2023-17 criteria for critical activities:

A third-party relationship involves a critical activity if it could:

• Cause a bank to face significant risk if the third party fails to meet expectations
• Have significant customer impacts
• Have a significant impact on the bank's financial condition or operations
• Involve critical bank functions (payments, clearing, settlements, custody)
• Involve significant shared bank or customer data

Apply a structured assessment:

Criticality Factor	Assessment Criteria
Financial impact	Revenue dependency, loss exposure if disrupted
Operational impact	Process dependency, recovery time objectives
Customer impact	Customer data exposure, service delivery reliance
Regulatory impact	Regulated activity involvement, compliance obligations
Substitutability	Alternative provider availability, transition complexity
Data sensitivity	Volume and classification of data shared

Classify as: Critical (enhanced due diligence required) or Non-Critical (standard due diligence).

Step 2: Due Diligence Assessment

Evaluate the third party across required due diligence domains per OCC 2023-17:

• Financial condition: Analyze audited financial statements, credit ratings, going-concern indicators. Assess financial viability over the contract term.
• Business experience and reputation: Evaluate industry tenure, client references, regulatory history, litigation exposure, media and public reputation.
• Information security: Review SOC 2 Type II reports, penetration test results, vulnerability management programs, incident response capabilities, data encryption practices.
• Operational resilience: Assess BCP/DR plans, RTO/RPO commitments, geographic diversification, pandemic preparedness, testing frequency and results.
• Compliance management: Evaluate regulatory compliance programs, applicable licensing, AML/BSA controls (if applicable), consumer protection practices.
• Human resources: Assess training programs, background check practices, key-person dependencies, employee turnover in critical roles.
• Subcontractor management: Identify fourth-party dependencies, assess the vendor's subcontractor oversight program, evaluate concentration risk in the supply chain.

Step 3: Risk Assessment and Scoring

Apply a multi-dimensional risk scoring model:

Risk Domain	Weight	Assessment Areas
Strategic risk	15%	Alignment with bank strategy, market position, innovation capability
Operational risk	25%	Service delivery, process maturity, incident history, resilience
Compliance risk	20%	Regulatory adherence, licensing, consumer protection, change management
Information security risk	20%	Data protection, access controls, vulnerability management, breach history
Financial/credit risk	10%	Financial stability, concentration, pricing sustainability
Reputation risk	10%	Public perception, litigation, regulatory actions, media exposure

Score each domain: 1 (Low) to 4 (Critical). Weighted aggregate determines the overall risk rating.

Step 4: Contract Risk Assessment

Evaluate key provisions: performance SLAs with remedies, audit and examination rights for bank and regulators, data ownership and return/destruction obligations, subcontracting approval and flow-down requirements, BCP/DR obligations and testing, termination provisions with transition assistance, insurance coverage (cyber, E&O, general liability), and indemnification commensurate with risk.

Step 5: Ongoing Monitoring Framework Assessment

Evaluate: monitoring frequency commensurate with risk and criticality, KPIs/KRIs defined and reported to governance bodies, escalation triggers for performance deterioration and security incidents, annual due diligence refresh scheduled, and relationship manager accountability clearly defined.

Step 6: Concentration and Portfolio Risk Analysis

Assess systemic portfolio risks: vendor concentration (single vendors across multiple services), geographic concentration (regional disaster/geopolitical exposure), technology concentration (shared platforms across vendors), fourth-party concentration (multiple vendors relying on same subcontractors like cloud providers), and revenue concentration (mutual dependency risk).

Step 7: Summary Report Generation

Compile findings into a structured risk assessment summary suitable for committee review and regulatory examination.

Output Specification

# Third-Party Risk Assessment Summary

## Vendor Overview
| Field | Detail |
|-------|--------|
| Vendor Name | [name] |
| Services Provided | [description] |
| Contract Term | [start] - [end] |
| Annual Spend | [$amount] |
| Criticality Classification | [Critical / Non-Critical] |
| Overall Risk Rating | [Low / Moderate / High / Critical] |
| Relationship Manager | [name] |

## Executive Summary
[2-3 paragraphs summarizing the risk profile, key findings, and recommended actions]

## Criticality Assessment
[Detailed assessment against OCC 2023-17 critical activity criteria]

## Due Diligence Findings
### Financial Condition
[Analysis with supporting data]

### Information Security
[SOC report findings, security assessment results]

### Operational Resilience
[BCP/DR assessment, RTO/RPO evaluation]

### Compliance
[Regulatory compliance assessment, licensing verification]

### Subcontractor / Fourth-Party Risk
[Key dependencies, oversight assessment]

## Risk Scoring
| Risk Domain | Score (1-4) | Key Factors |
|------------|-------------|-------------|

## Contract Risk Assessment
[Key contractual provision evaluation]

## Monitoring Recommendations
[Frequency, KPIs, KRIs, escalation triggers]

## Concentration Risk Considerations
[Portfolio-level concentration analysis]

## Action Items
| Priority | Action | Owner | Due Date |
|----------|--------|-------|----------|

## Appendix
[Supporting documentation references, SOC report summary, financial ratio analysis]

Analysis Framework

Third-party risk escalation matrix:

Overall Risk Rating	Governance Requirements
Critical (3.5-4.0)	Board-level oversight, quarterly monitoring, enhanced due diligence, contingency planning
High (2.5-3.4)	Senior management oversight, semi-annual monitoring, annual due diligence refresh
Moderate (1.5-2.4)	Management oversight, annual monitoring, periodic due diligence refresh
Low (1.0-1.4)	Standard oversight, annual review, standard due diligence cycle

Examples

Example 1 — Critical Vendor Assessment: "CoreBanking Solutions LLC provides the institution's core banking platform serving 1.2M customer accounts. The relationship is classified as Critical under OCC 2023-17 due to: (1) significant operational dependency with no viable short-term alternative, (2) access to all customer PII and financial data, (3) direct impact on regulatory reporting capabilities. The vendor's SOC 2 Type II report contained two exceptions related to access provisioning controls, and financial analysis indicates declining operating margins (18% to 12% over 3 years). Recommend: Enhanced quarterly monitoring, updated contingency/exit plan, and escalation of SOC exceptions to the Technology Risk Committee."

Example 2 — Concentration Risk Finding: "Portfolio analysis reveals that Amazon Web Services (AWS) serves as the primary infrastructure provider for 7 of the institution's 12 critical vendors, representing a significant fourth-party concentration risk. A sustained AWS outage could simultaneously impact core banking, payments processing, fraud detection, and customer communications. Recommend: (1) Mandate multi-cloud resilience requirements for critical vendors, (2) Conduct a tabletop exercise simulating extended AWS outage, (3) Report fourth-party concentration to the Enterprise Risk Committee."

Guidelines

• Apply due diligence rigor commensurate with the criticality classification and risk rating
• Consider the entire lifecycle: planning, due diligence, negotiation, ongoing monitoring, termination
• Assess risk from the institution's perspective, not solely based on vendor self-assessments
• Evaluate SOC reports critically; review complementary user entity controls and noted exceptions
• Consider the cumulative risk of the third-party portfolio, not just individual relationships
• Engage subject matter experts for specialized assessments (information security, legal, compliance)
• Document all assessments to support regulatory examination readiness
• Ensure board-level reporting includes critical vendor risk summaries and emerging concentration risks

Validation Checklist

• Criticality classification completed using OCC 2023-17 criteria
• All due diligence domains assessed with supporting evidence
• Risk scoring applied consistently; SOC reports reviewed with exceptions tracked
• Financial viability assessed with quantitative ratio analysis
• Contract provisions evaluated against regulatory expectations
• Fourth-party dependencies identified and assessed
• Concentration risk analysis performed at portfolio level
• Monitoring plan defined with frequency, KPIs, and escalation triggers
• Report formatted for committee consumption and regulatory examination