Managing third-party risk throughout the relationship

Accountability continues after outsourcing

Using a third party changes how a service is delivered; it does not remove the organization’s need to understand and manage the resulting risks. Begin with the service, its importance and the consequences of failure.

Before the arrangement

Assess suitability, financial resilience, security, data handling and relevant subcontracting. Establish responsibilities, service expectations, information access and incident communication. Contract provisions should reflect the arrangement’s risks and applicable requirements.

During the relationship

Monitor performance and material changes, including concentration and dependencies beyond the immediate supplier. A risk-based approach focuses effort on arrangements whose disruption would matter most. Supplier assurances should be assessed against evidence, rather than accepted as a substitute for oversight.

Prepare for disruption and exit

Consider continuity arrangements, recovery coordination and feasible transition options. Identify data, skills and resources needed to move or recover the service. OSFI’s B-10 provides supervisory expectations for institutions within its scope; applicability and proportionality need to be assessed for the particular organization.

Reference

OSFI / BSIF — B-10 (opens in a new tab)

This website provides general information about Facultas Advisory and its services. Its content is not professional advice for any particular circumstances; advice requires an agreed engagement scope.

Services — Operational Resilience

Discuss a mandate