Ask which outside providers could materially affect the service you use, what they do, and how your vendor manages that reliance. Fourth-party risk commonly means risk reaching you through your vendor’s suppliers or subcontractors. You usually manage that exposure through your direct vendor relationship.
Ask about the service, not the entire company
A request for every supplier your vendor uses can produce a large list with little decision value. Begin with dependencies that handle your information, support an important service function, have privileged access or could prevent timely recovery. A caterer for the vendor’s office is unlikely to deserve the same attention as the hosting provider for your production service.
- Which external providers perform those functions, and what information or access do they receive?
- How do you assess and monitor them for this service?
- What happens to our service if one is unavailable or fails to meet expectations?
- How are material dependency changes communicated to us?
- What evidence can you share about the oversight and recovery arrangements?
Look for an explanation that connects to your exposure
“We review all vendors annually” leaves important questions unanswered. A more useful explanation identifies the relevant function, who oversees it, what happens when a concern is found, and how the service recovers. Request evidence for an important uncertainty rather than collecting every available document.
If names or detailed reports cannot be shared, explore suitable alternatives: a service-specific dependency description, a controlled review, relevant independent assurance or a documented explanation of oversight. Record what remains unknown. Limited visibility may be manageable for one use and unacceptable for another.
Do not assume direct control over the fourth party
Your agreement with a vendor does not automatically give you direct audit rights over its suppliers. Access, notices and other rights depend on the actual arrangements and applicable requirements. Discuss important gaps with the vendor and the people responsible for your contracts before relying on rights you do not have.
The banking agencies’ guidance treats subcontractor reliance and the vendor’s ability to oversee it as due-diligence considerations. That bank-specific guidance supports the distinction between identifying a dependency and understanding how it is managed.
The decision: do you understand the important dependency well enough to accept the service, or do you need more evidence, a contingency, a narrower use or a different provider?
Explore the Third-party Risk guide for related questions and practical approaches.