Third-Party Risk Management Standard Operating Procedure

THIRD-PARTY RISK MANAGEMENT STANDARD OPERATING PROCEDURE

Organization: [________________________________]
SOP Number: TPRM-[____]
Version: [____]
Effective Date: [__/__/____]
Approved By: [________________________________]
Document Owner: [________________________________]

TABLE OF CONTENTS

1. Purpose and Scope
2. Regulatory Framework and Authority
3. Definitions
4. Risk Tiering Methodology
5. Third-Party Lifecycle Management
6. Roles, Responsibilities, and RACI Matrix
7. Documentation and Systems of Record
8. Metrics, Key Risk Indicators, and Reporting
9. Exceptions and Compensating Controls
10. Review Cadence and Version Control
11. Annexes

1. PURPOSE AND SCOPE

1.1 Purpose

This Standard Operating Procedure ("SOP") establishes the framework for identifying, assessing, managing, monitoring, and offboarding third-party relationships throughout their lifecycle. It draws on OCC Bulletin 2023-17, FFIEC handbook guidance, and the DOJ's Evaluation of Corporate Compliance Programs. OCC Bulletin 2023-17 is risk-based supervisory guidance for banking organizations supervised by the Board, FDIC, or OCC; it does not have the force and effect of law or impose new requirements. An organization outside that audience may use its lifecycle principles as a voluntary framework, subject to the laws and regulatory guidance actually applicable to that organization. The SOP also supports an organization's fact-specific compliance-program analysis under Federal Sentencing Guidelines § 8B2.1.

1.2 Scope

This SOP applies to all third-party relationships where the third party:

☐ Accesses, processes, stores, or transmits company data
☐ Has connectivity to company information systems
☐ Interacts directly with the organization's customers or end users
☐ Performs critical business functions or provides essential operational support
☐ Is a subcontractor of a direct vendor performing any of the above

This includes vendors, service providers, consultants, outsourcing partners, joint ventures, affiliates performing services, and other relationships the organization places within this policy. For a supervised banking organization, OCC Bulletin 2023-17 uses "business arrangement" broadly and treats it as synonymous with "third-party relationship."

1.3 Exclusions

The following relationships may be excluded from full lifecycle procedures, though they must still be inventoried:

☐ Utility providers (electricity, water, basic telecommunications)
☐ One-time purchases of goods with no data access or system connectivity
☐ Government regulators and auditors

2. REGULATORY FRAMEWORK AND AUTHORITY

This SOP is informed by the following potentially applicable authorities and voluntary frameworks. Applicability must be determined for the organization and relationship; an item below is not automatically a legal requirement merely because it is listed here:

3. DEFINITIONS

4. RISK TIERING METHODOLOGY

4.1 Tiering Criteria

Each third party shall be assigned a risk tier based on the following factors:

4.2 Scoring and Assignment

Risk tier is determined by the highest-rated factor unless overridden by documented professional judgment. Override decisions require approval from [________________________________] and must be documented with rationale.

4.3 Tier-Based Requirements

5. THIRD-PARTY LIFECYCLE MANAGEMENT

5.1 Phase 1: Planning and Intake

Objective: Identify the business need, assess alternatives, and initiate the TPRM process.

☐ Intake form submitted to TPRM Platform
☐ Preliminary tier assigned
☐ Approval authority identified

5.2 Phase 2: Due Diligence and Risk Assessment

Objective: Assess the third party's ability to deliver services while managing risk.

☐ Questionnaire completed and reviewed
☐ Evidence collected and validated
☐ Screenings clear (or findings documented)
☐ Risk assessment report completed
☐ Approval decision documented

5.3 Phase 3: Contract Negotiation and Execution

Objective: Ensure contractual terms appropriately allocate risk and address regulatory requirements.

Internal baseline contract terms by risk tier are listed below. These are organization policy choices to tailor to relationship risk and applicable law; OCC Bulletin 2023-17 does not prescribe every listed term for every relationship:

☐ Contract reviewed by Legal
☐ Contract reviewed by Compliance/Security/Privacy (per tier)
☐ Deviations from required terms documented with compensating controls
☐ Contract executed and filed in contract repository

5.4 Phase 4: Onboarding

☐ Controls validated
☐ Access provisioned
☐ Monitoring enabled
☐ TPRM system updated

5.5 Phase 5: Ongoing Monitoring

☐ Monitoring schedule documented
☐ Incidents tracked and escalated per SOP
☐ Material changes evaluated and acted upon

5.6 Phase 6: Periodic Reassessment

☐ Reassessment questionnaire issued
☐ Updated evidence collected
☐ Risk tier re-evaluated
☐ Findings documented and remediation tracked

5.7 Phase 7: Offboarding and Termination

☐ Data returned or deletion certified
☐ Access revoked
☐ TPRM system updated to "Terminated"
☐ Records retained per policy

6. ROLES, RESPONSIBILITIES, AND RACI MATRIX

6.1 Key Roles

6.2 RACI Matrix

R = Responsible, A = Accountable, C = Consulted, I = Informed

7. DOCUMENTATION AND SYSTEMS OF RECORD

7.1 TPRM Platform

All TPRM activities shall be documented in the designated platform: [________________________________]

The platform shall maintain:

☐ Third-party inventory (active and terminated)
☐ Intake forms and tier assignments
☐ Questionnaires and evidence packages
☐ Screening results
☐ Risk assessment reports
☐ Approval records
☐ Contract references (linked to contract repository)
☐ Monitoring notes and incident records
☐ Reassessment history
☐ Exception requests and approvals
☐ Offboarding checklists and certifications

7.2 Record Retention

TPRM records shall be retained for a minimum of [____] years after termination of the relationship, or longer if required by applicable law or regulation.

8. METRICS, KEY RISK INDICATORS, AND REPORTING

8.1 Program Metrics

8.2 Reporting

9. EXCEPTIONS AND COMPENSATING CONTROLS

9.1 Exception Process

9.2 Approval Authority for Exceptions

10. REVIEW CADENCE AND VERSION CONTROL

Version History:

11. ANNEXES

Annex A: Third-Party Intake Form Fields

☐ Vendor legal name and contact information
☐ Business use case and justification
☐ Data types and volumes
☐ System integrations and access requirements
☐ Geographies (vendor operations and data locations)
☐ Alternatives considered
☐ Estimated contract value and term
☐ Requested risk tier (subject to TPRM review)

Annex B: Risk Tiering Scoring Model

[Insert organization-specific scoring rubric with point values for each factor in Section 4.1]

Annex C: Required Contract Clauses Checklist by Tier

[Reference the table in Section 5.3 for minimum contractual requirements]

Annex D: Reassessment Checklist and Evidence Requirements

☐ Updated questionnaire responses
☐ Current SOC 2 / ISO 27001 / PCI DSS report or certificate
☐ Recent penetration test summary
☐ Updated subprocessor list
☐ Insurance certificate renewal
☐ Incident history since last assessment
☐ SLA performance report
☐ Financial review (Critical/High tier)
☐ Updated sanctions/PEP screening
☐ Privacy assessment update (if data types/flows changed)

SOURCES AND REFERENCES

• OCC Bulletin 2023-17, "Third-Party Relationships: Risk Management Guidance" (June 6, 2023; risk-based supervisory guidance for banking organizations supervised by the Board, FDIC, or OCC; not law)
• OCC Bulletin 2013-29, "Third-Party Relationships" (Oct. 30, 2013; rescinded and replaced by OCC Bulletin 2023-17)
• FFIEC IT Examination Handbook, "Outsourcing Technology Services"
• CFPB Bulletin 2012-03, "Service Providers" (Apr. 13, 2012)
• DOJ, "Evaluation of Corporate Compliance Programs" (rev. Mar. 2023)
• U.S. Sentencing Guidelines § 8B2.1 (Effective Compliance and Ethics Program)
• NIST SP 800-161 Rev. 1, "Cybersecurity Supply Chain Risk Management Practices" (May 2022)
• ISO/IEC 27001:2022, Annex A Controls 5.19–5.22

This template is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel before use.