Vendor risk management
Assessing and monitoring the risks third parties bring, from onboarding through exit.
Overview
Regulators hold firms responsible for outsourced activities. Rules such as DORA, OSFI’s third-party guideline and US interagency guidance require due diligence, contracts, monitoring and exit plans.
It connects most directly to DORA and Business continuity.
Check the official sources below for legal scope, applicable dates and exceptions. This entry is an explanatory reference, not legal advice.
Why it matters
You can outsource the activity, but not the accountability.
Who it affects
Regulated firms using vendors and cloud providers.
Where it sits
Ten linked steps connect where you operate to the proof that you complied.
- 01Jurisdiction
- 02Industry
- 03Activity
- 04Authority
- 05Regulation
- 06Requirement
- 07Guidance
- 08Control
- 09Evidence
- 10Enforcement
Connections
The terms most closely tied to Vendor risk management. Select one to open it.
What to do about it
- 1Define the owner, frequency, data and pass condition.
- 2Automate the test on source data where you can.
- 3Capture evidence on every run, including exceptions.
- 4Review exceptions and failures and record the decision.
From requirement to evidence.
Third-party obligations are mapped to vendor controls, with evidence collected per vendor.
Request early access →