Third-party risk Q&A 

Jill Czerwinski: We challenge banks to start by looking at two criteria to determine whether the organization needs to monitor the financial health of a third-party vendor.

First, the bank should ask if the failure of the third-party vendor would affect the bank’s own resiliency, perhaps because the vendor provides a critical service or product that can’t be replaced quickly or easily.

Second, the bank should ask whether financial hardship of the third party might force cost-cutting that could affect the quality, risk, and delivery of services from the third party.

For example, you might be concerned if a third party that interacts with customers isn’t profitable. That lack of profitability might make the vendor more likely to cut costs, perhaps by scaling back the quantity and level of experience of their personnel resources. And that cost-cutting could directly affect customer service.

Jill Czerwinski: We typically recommend that banks start by profiling the third party. This process would start with determining whether the company is public or private as well as domestic or international. A private, global company can often introduce a lot more complexity and risk considerations than a public, domestic company.

We also look at the ownership structure, as in determining if the third party is a subsidiary of a larger company. Maybe you’re evaluating a small company that looks risky on paper, but it’s actually a key subsidiary of a very profitable larger company.

All these factors require consideration. Once we have a profile of the company, we can apply the right screening of the financial statements.

Jill Czerwinski: We request financial statements for the past three years to look at the third party’s historical performance. How has it performed in the past three years? Does it have income, and has revenue grown? Was there significant financial activity in the past 12 months – transactions, mergers, acquisitions – anything notable that can help us draw conclusions about financial health?

Jill Czerwinski: It is challenging, and of course we can’t truly predict the future, but there are things we can look at to make highly educated guesses about how the company might look in the future. For instance, is there any pending M&A activity? What about any pending litigation, recalls, quality issues, news events, or short-term supply chain impacts?

We also look at how reliant the vendor is on a small number of accounts or a particular market segment. For example, if the vendor serves a relatively small number of banks, will its financials change if its clients merge or even fail?

When we combine and aggregate all those past, present, and future elements, we can determine how risky this relationship is and how risky it is likely to be going forward, and then we can create a financial health risk treatment plan.

Jill Czerwinski: Minimally, you want to have a backup provider screened and ready to engage if needed. And ultimately, you might decide that the risk of a resiliency event is too great and opt for a third party with a stronger financial health profile.

The organization also might want to have more frequent “checkups” to monitor the third party’s financial health for change. In many organizations, the business unit that owns the relationship will interact with the third party quarterly to discuss performance and risk. Then, those relationship owners can report back with any changes, good or bad, regarding the financial health of the third party.