ANSWER:

The key to the effective and successful use of a third party in any capacity is for the institution’s management to appropriately assess, measure, monitor, and control the risks associated with the relationship and weave that process into its compliance management system (CMS).

While engaging another entity may aid management and the board in achieving strategic goals, such an arrangement reduces management’s direct control. Therefore, the use of a third party increases the need for robust oversight of the process from start to finish.

There are four main elements of an effective third-party risk compliance management process:

 

• Risk Assessment – The process of assessing risks and options for controlling third-party arrangements.
• Due Diligence in Selecting a Third Party – The process of selecting a qualified entity to implement the activity or program.
• Contract Structuring and Review – The process of ensuring that the specific expectations and obligations of both the institution and the third party are outlined in a written contract prior to entering into the arrangement—a contract should act as a map to the relationship and define its structure.
• Oversight – The process of reviewing the operational and financial performance of third-party activities over those products and services performed through third-party arrangements on an ongoing basis, to ensure that the third party meets and can continue to meet the terms of the contractual arrangement.

Reference: FDIC Compliance Examination Manual - March 2017, VII-4.4.