Do You Really Need to Review Every Third-Party the Same Way?

Do banks need to review every third-party vendor the same way?

No. Banks and credit unions should use a risk-based approach to third-party risk management. The level of vendor due diligence, ongoing monitoring, and oversight should reflect each relationship's inherent risk, including access to sensitive information, operational criticality, system connectivity, and regulatory exposure. Higher-risk vendors generally require more comprehensive reviews, while lower-risk vendors may warrant simpler assessments.

Third-party relationships are essential to the operations of financial institutions. From core providers and online banking platforms to consultants and office supply vendors, we rely on third-party providers to support a wide range of business activities.

With each third-party relationship, some level of risk is introduced. But does every vendor present the same level of risk? And if they don't, should we really be reviewing every third party using the same process, questionnaires, and level of scrutiny?

The short answer is no.

An effective third-party risk management program should be risk-based. This means the level of due diligence, oversight, and ongoing monitoring should be proportionate to the risk associated with each individual relationship.

Regulatory Expectations

This topic is particularly timely given the proposed changes to interagency third-party risk management guidance.

On September 11, 2026, the Office of the Comptroller of the Currency (OCC), Federal Reserve Board, Federal Deposit Insurance Corporation (FDIC), and National Credit Union Administration (NCUA) issued proposed interagency guidance intended to revise and replace the existing 2023 Interagency Guidance on Third-Party Relationships: Risk Management.

One of the primary objectives of the proposal is to encourage financial institutions to better align their third-party risk management practices with the reasonably assessed risk levels of individual relationships.

The agencies acknowledge that the existing guidance has sometimes been interpreted in ways that result in overly burdensome processes and heightened oversight without sufficient consideration of the actual risks involved.

The proposed guidance emphasizes a more tailored approach, encouraging institutions to prioritize resources based on material financial risks, regulatory compliance, and the nature of their third-party relationships.

It also recognizes that an institution's size, complexity, and risk profile should influence how its third-party risk management program is structured.

The message is straightforward: Effective third-party risk management should be driven by risk, not simply by process.

Not All Third Parties Present the Same Risk

Consider two different third-party relationships.

One vendor provides a marketing service and receives limited information necessary to perform its work. Another provides a cloud-based platform that processes and stores nonpublic customer information and has direct connectivity to the financial institution’s network.

Should these vendors receive the same level of scrutiny?

Clearly, the second relationship introduces significantly different risks. A compromise involving the cloud service provider could potentially expose sensitive customer information, disrupt critical operations, or provide an avenue for unauthorized access to the institution's network.

The marketing vendor presents a different, potentially lower level of risk, depending on the information shared, services performed, and access provided.

This is why we should evaluate third parties based on the nature of the relationship, rather than simply applying a standard review process to every vendor.

It is also important to recognize that two vendors providing similar services may still present different levels of risk. The information they access, the security controls they maintain, their connectivity to the institution, and their reliance on subcontractors can all influence the overall risk assessment.

Start With the Risk

One of the most important steps in an effective third-party risk management program is understanding the inherent risk associated with a relationship before determining the level of due diligence required.

We should consider several factors when evaluating a third party, including:

• Access to Information: Does the vendor have access to nonpublic customer information, confidential bank information, or other sensitive data?
• System Access and Connectivity: Does the vendor have access to our network, systems, applications, or infrastructure?
• Criticality of Services: Would the loss or disruption of the vendor's services significantly impact our operations or customers?
• Regulatory and Compliance Exposure: Does the relationship introduce regulatory, legal, privacy, or compliance considerations?
• Operational Dependency: How difficult would it be to replace the vendor or transition services to another provider?
• Fourth-Party Risk: Does the vendor rely on subcontractors or other service providers that could introduce additional risk?
• Concentration Risk: Do we rely heavily on a particular provider or a small number of providers for critical services?

These considerations help us determine the inherent risk of a relationship and establish an appropriate level of due diligence.

The evaluation should consider the actual services being provided and the information and access required to perform them.

Match Due Diligence to the Level of Risk

Once we establish and understand the inherent risk, we can determine the appropriate level of due diligence that should be performed.

A practical way to implement this approach is to establish risk tiers that define expectations for due diligence and ongoing oversight.

For example, we might establish three general risk tiers:

Low-Risk Third Parties

These relationships typically involve limited services, no access to sensitive customer information, and little to no connectivity to our network.

Due diligence may include:

• • Basic business and reputational reviews.
  • Review of the services being provided.
  • Appropriate contractual provisions.
    
    

Moderate-Risk Third Parties

These relationships may involve access to certain information types, support important business processes, or services that could affect operations if disrupted.

Due diligence may include:

• • Review of information security policies and practices.
  • Evaluation of relevant security controls.
  • Review of business continuity and disaster recovery capabilities.
  • Assessment of incident response practices
    
    

High-Risk or Critical Third Parties

These relationships may involve access to sensitive customer information, significant network connectivity, or services essential to our operations.

Due diligence should be more comprehensive and may include:

• • Detailed review of independent audit reports, such as SOC reports.
  • Evaluation of information security controls and vulnerability management practices.
  • Review of penetration testing results.
  • Assessment of incident response and business continuity capabilities.
  • Evaluation of subcontractor and fourth-party risks.
  • Review of financial condition and operational resilience.
  • More detailed contractual protections, including audit rights, incident notification, and termination provisions.
    
    

Ongoing Monitoring Should Follow the Same Approach

Risk-based oversight should not stop once the initial due diligence is complete.

We must establish ongoing monitoring requirements that are also proportionate to the risk of the relationship.

For example, a critical service provider with access to sensitive customer information warrants more frequent reviews, closer monitoring of security developments, and regular evaluation of independent audit reports.

A lower-risk vendor may only require periodic confirmation that the services being provided and the associated risks have not materially changed.

We should also recognize that risk classifications are not permanent. A vendor initially categorized as low risk may become moderate or high risk if its services expand. Additionally, changes in ownership, subcontractors, security posture, or business operations may also warrant reassessment.

The goal is to ensure that the level of oversight continues to reflect the actual risk of the relationship.

A More Effective Approach to Third-Party Risk Management

The objective of a third-party risk management program should not be to make every review look the same. It should be to ensure that we understand the risks associated with the relationship and have appropriate controls and oversight in place to manage the risks.

The proposed interagency guidance provides an opportunity for us to take another look at our existing programs and consider whether their current processes are appropriately aligned with the risks our third-party relationships introduce.

Ultimately, the question isn't whether every vendor has completed the same questionnaire or provided the same documentation.

The question is whether we have done enough to understand and manage the risk that each third-party relationship introduces.

Effective third-party risk management isn't about doing more reviews. It's about doing the right reviews, at the right level, for the right reason. If this is something your bank or credit union struggles with, don't hesitate to reach out and explore whether our services might be a good fit.

Frequently Asked Questions About Third-Party Risk Management

Do all third-party vendors require the same level of due diligence?

No. Financial institutions should tailor due diligence to the inherent risk of each third-party relationship. Vendors with access to sensitive customer information or critical banking systems generally require more extensive reviews than vendors with limited access and minimal operational impact.

What determines whether a third-party vendor is high risk?

A vendor's risk level depends on factors such as access to nonpublic customer information, network connectivity, operational criticality, regulatory exposure, subcontractor dependencies, and concentration risk. Financial institutions should evaluate these factors before establishing due diligence requirements.

How often should banks review third-party vendors?

Banks should establish review frequencies based on each relationship's risk level. Critical or high-risk vendors generally warrant more frequent monitoring, while lower-risk vendors may require less intensive periodic reviews. Material changes in services, ownership, access, or security posture should also trigger reassessment.

What is the difference between inherent risk and residual risk in third-party management?

Inherent risk is the risk associated with a third-party relationship before considering mitigating controls. Residual risk is the risk remaining after evaluating those controls. Both can help financial institutions determine appropriate oversight and whether additional risk mitigation is necessary.

Is Your Third-Party Risk Management Program Aligned with Your Risk?

Managing third-party risk shouldn't mean applying the same level of scrutiny to every vendor. Bedel Security helps community banks and credit unions evaluate cybersecurity risks, strengthen oversight, and take a practical, risk-based approach to third-party management.

Let's discuss how we can support your institution's third-party risk management efforts.

Talk to our team.

Regulatory References

This article references the Proposed Third-Party Risk Management Guidance issued by the OCC, Federal Reserve Board, FDIC, and NCUA on September 11, 2026, and published in the Federal Register on September 15, 2026 (91 FR 58536).

The proposal is subject to public comment and is not finalized. The existing 2023 Interagency Guidance on Third-Party Relationships: Risk Management remains in effect unless and until superseded by finalized guidance.

The public comment period for the proposed guidance closes November 16, 2026.