Challenges in Managing Fourth- and Nth-Party Risks and Solutions

Managing third-party risks can be a complex task. With a changing regulatory and technological landscape, even experienced professionals find it challenging to stay on top of evolving risks. In addition to these difficulties, there are also risks associated with fourth parties – the vendors of your vendors. These additional parties can add another layer of complexity to third-party risk management (TPRM).

Managing fourth and nth parties isn’t the easiest skill to master, but one that’s necessary to gain a broader understanding of your organization’s risk landscape. The good news is that there are a few best practices that can help. Once you know how to identify, assess, and manage your fourth and nth parties, your overall TPRM program will be much more effective.

Challenges in Managing Fourth- and Nth-Party Risks

Fourth parties are the vendors that have a direct contract with your third parties, while nth parties are essentially all the vendors of your fourth parties and beyond. As you can imagine, these degrees of separation can create many challenges when it comes to managing risk, such as:

No choice

With few exceptions, your organization generally can’t choose your fourth or nth parties. In some cases, your third parties may have a different risk appetite than your organization regarding a particular vendor. This might create a situation where you decline working with a third party because of its vendor inventory.

No direct relationship

Your organization has no direct relationship with fourth and nth parties, which means you likely can’t perform TPRM practices, like risk assessments, due diligence, and ongoing monitoring. These practices must instead be performed by your third parties. Organizations often have little to no influence on how nth parties respond.

No contract

Since your organization doesn’t have a direct relationship with a fourth or nth party, there’s no contract to protect the organization from risk. Without a contract, there’s also no leverage to manage fourth parties’ performance or set any expectations around service level agreements (SLAs) and data breach notifications.

No due diligence 

Managing fourth- and nth-party risks is especially challenging when you don’t have the ability to perform due diligence. Fourth and nth parties typically don’t provide documentation unless an organization has a direct contract. Your organization may have a high-level view of nth-party risks, but many details will still be unknown.

Solutions to Managing Fourth- and Nth-Party Risks

When your organization has no direct relationship and no leverage to perform risk management activities, it can seem almost impossible to manage fourth- and nth-party risks. However, there are still practices to implement to mitigate the risks. The most effective strategy is to manage risk through your third parties, with whom you do have leverage.

Here are five solutions to manage your fourth and nth parties:

1. Require Transparency

Third parties should be required to disclose which of their vendors have an impact on your organization. These vendors might access sensitive information or be essential to your third party’s operations. Your organization should essentially identify your third party’s critical vendors. Fortunately, these critical vendors will be listed in the third party’s SOC report. Focusing on critical fourth parties is a much easier solution than trying to create a complete list of every fourth and nth party.

2. Review TPRM practices

Since you can’t manage fourth- or nth-party risk directly, it’s important for your third parties to have effective TPRM practices in place. When reviewing due diligence and monitoring your own third parties, you’ll need to evaluate how they manage their vendors’ risk. Make sure your third parties are performing their TPRM activities effectively and consistently.

3. Leverage contracts

When onboarding a new vendor, there are a few ways to use the third-party contract to manage fourth-party risk and beyond. Consider adding contractual provisions that obligate third parties to manage their vendors through SLAs, data breach notifications, and a right to audit. This will ensure third parties are following the same TPRM best practices as your organization.

4. Manage any issues

Suppose you discover your third party doesn't assess their vendors, verify controls, or monitor risks. When issues arise, communicate with the third party and amend the contract, if possible, to require stronger TPRM practices. Any issues should be documented through remediation and reported to senior management and the board.

5. Reconsider the relationship

There will always be some level of fourth-party risk in third-party relationships, so your organization needs to determine for itself what’s acceptable. Depending on your organization’s risk appetite, strategic goals, and other factors, you may decide it’s best to reconsider the third-party relationship. This can mean either selecting a different third party during onboarding or proceeding with your exit strategy if you’ve signed the contract.

Managing fourth- and nth-party risk can be complex. While you may not have a direct relationship or contract with fourth parties, it’s crucial to ensure your third parties are transparent about their third-party relationships and have robust third-party risk management practices.

Your organization needs documented evidence from your third parties of fourth-party risk assessments, due diligence, and monitoring to ensure your third parties are managing their vendors safely. This visibility will give your organization confidence in the appropriate management of fourth-party vendors.