--- title: "Navigating Third-Party Risk Management: Roles and Responsibilities" description: Outsourcing and third-party risk management roles and responsibilities. TPRM compliance consulting service. image: https://www.thefourthline.co.uk/hubfs/231002%20TPRM-Video-blog-1.jpg --- [![logo](https://www.thefourthline.co.uk/hubfs/logo.svg) ![logo](https://www.thefourthline.co.uk/hubfs/logo.svg)](https://www.thefourthline.co.uk) [![logo](https://www.thefourthline.co.uk/hubfs/logo.svg)](https://www.thefourthline.co.uk) - [About](https://www.thefourthline.co.uk/blog/javascript;) - [About](https://www.thefourthline.co.uk/about) - [Insights](https://www.thefourthline.co.uk/blog) - [Contact](https://www.thefourthline.co.uk/contact) - [Solutions](https://www.thefourthline.co.uk/blog/javascript;) - [What we do](https://www.thefourthline.co.uk/solutions/what-we-do) - [Operational Resilience & BCM](https://www.thefourthline.co.uk/solutions/operational-resilience-bcm) - [Third Party Risk Management](https://www.thefourthline.co.uk/solutions/third-party-risk-management) - [ICT & Technology Resilience](https://www.thefourthline.co.uk/solutions/ict-technology-resilience) - [Cyber Resilience](https://www.thefourthline.co.uk/solutions/cyber-resilience) - [How We Work](https://www.thefourthline.co.uk/blog/javascript;) - [Diagnostic Assessment](https://www.thefourthline.co.uk/how-we-work/diagnostic-assessment) - [Annual Resilience Retainer](https://www.thefourthline.co.uk/how-we-work/annual-resilience-retainer) - [Managed Services](https://www.thefourthline.co.uk/how-we-work/managed-services) - [Sectors](https://www.thefourthline.co.uk/blog/javascript;) - [Insurance](https://www.thefourthline.co.uk/sectors/insurance) - [Banking](https://www.thefourthline.co.uk/sectors/banking) - [Investment Management](https://www.thefourthline.co.uk/sectors/investment-management) - [About](https://www.thefourthline.co.uk/blog/javascript;) - [About](https://www.thefourthline.co.uk/about) - [Insights](https://www.thefourthline.co.uk/blog) - [Contact](https://www.thefourthline.co.uk/contact) - [Solutions](https://www.thefourthline.co.uk/blog/javascript;) - [What we do](https://www.thefourthline.co.uk/solutions/what-we-do) - [Operational Resilience & BCM](https://www.thefourthline.co.uk/solutions/operational-resilience-bcm) - [Third Party Risk Management](https://www.thefourthline.co.uk/solutions/third-party-risk-management) - [ICT & Technology Resilience](https://www.thefourthline.co.uk/solutions/ict-technology-resilience) - [Cyber Resilience](https://www.thefourthline.co.uk/solutions/cyber-resilience) - [How We Work](https://www.thefourthline.co.uk/blog/javascript;) - [Diagnostic Assessment](https://www.thefourthline.co.uk/how-we-work/diagnostic-assessment) - [Annual Resilience Retainer](https://www.thefourthline.co.uk/how-we-work/annual-resilience-retainer) - [Managed Services](https://www.thefourthline.co.uk/how-we-work/managed-services) - [Sectors](https://www.thefourthline.co.uk/blog/javascript;) - [Insurance](https://www.thefourthline.co.uk/sectors/insurance) - [Banking](https://www.thefourthline.co.uk/sectors/banking) - [Investment Management](https://www.thefourthline.co.uk/sectors/investment-management) Book a 30-Minute Briefing ###### Investment & Asset Management / Insurance Sector / Retail Finance # Navigating Third-Party Risk Management: Roles and Responsibilities **Read Time:** 3 min | October 02, 2023 The need to protect an organisation from operational risks linked to third-party relationships is paramount, as illustrated by [MS Amlin's operational risk failings](https://www.bankofengland.co.uk/news/2022/october/pra-fines-ms-amlin-underwriting-limited) and the subsequent fine by the Prudential Regulation Authority (PRA) in October 2022.  One of the primary challenges faced in Third-Party Risk Management is the unclear delineation of roles and responsibilities. This issue is not unique to a specific organisation but is a widespread problem observed across various firms.  Here, we'll dive into how this impacts the effectiveness of Third-Party Risk Management programmes. Insufficient Second-Line Capacity We often find that the second line of defence lacks the necessary capacity to provide the level of oversight required for a robust operational risk management program. This is particularly challenging given the multitude of suppliers that support most financial services firms.  The consequence is Third-Party Risk Management scope becomes limited and typically focuses primarily on the onboarding process.  Once supplier contracts are signed, and business relationships commence, there is often no further assessment or oversight of these suppliers from a risk perspective. The first line of defence, in the absence of appropriate second line guidance and training, typically gravitates towards a supply performance model. This means they concentrate on Service Level Agreements (SLAs), performance metrics, relationship management and handling complaints.  They frequently overlook crucial risk-related questions, such as the stability of suppliers, how suppliers manage their own risks, and whether these align with the organisation's risk appetite. This deviation from risk management best practices results from the lack of clear policy and controls in place. Smaller firms or those without well-defined operational risk policies are particularly vulnerable to this challenge. In many cases, the person responsible for risk management within these firms often wears multiple hats.  For example, they may serve as the Head of Risk and Compliance, which may lead to a focus on regulatory reporting and compliance rather than robust Third-Party Risk Management. Recommendations for Effective Third-Party Risk Management Roles and Responsibilities To address these issues and ensure a well-rounded Third-Party Risk Management programme, organisations should consider the following recommendations: 1. Clear Policy and Framework: Develop a comprehensive Third-Party Risk Management policy and framework that outlines the procedures and responsibilities for managing third-party risks. Ensure that this policy is integrated into the broader risk management framework. 2. Dedicated Resources: Allocate dedicated resources to Third-Party Risk Management, especially in firms dealing with a large number of suppliers. This could involve hiring specialist professionals or providing training to existing staff. 3. Role Clarification: Clearly define the roles and responsibilities of individuals involved in the supplier lifecycle. Ensure that the focus considers both risk oversight and relationship management. 4. Communication and Training: Promote communication and collaboration between the first and second lines of defence. Provide training to first-line staff to ensure they understand the importance of Third-Party Risk Management and how it aligns with the firm's risk appetite. Conclusion The challenges related to unclear roles and responsibilities within Third-Party Risk Management can have far-reaching consequences. Effectively managing third-party risks is a critical component of a sound operational risk management program.  By enhancing their approach, firms can better navigate the complexities of Third-Party Risk Management, reduce operational risk, and enhance their overall risk management and operational resilience capabilities.    How FourthLine can help  **If you would like to understand how FourthLine could [support your firm](https://www.thefourthline.co.uk/insight-case-studies/tprm-insurance-sector) with an enhanced third-party risk management approach, please [get in touch](https://share.hsforms.com/1g1MeQ-8PQSCYzLfpQbAtDQ3mkmc)**     ### Daniel Waltham, Responsible for leading client relationships and new business sales. Dan takes a lead role in customer engagement, identifying, creating and designing solutions to help our customers with risk and regulatory challenges. 13 years of experience working with financial services businesses across risk, compliance, data protection and regulatory change. ###### Download Assessment Guide Download our Op Res and BCM Diagnostic Assessment Guide [Download the Diagnostic Assessment](https://www.thefourthline.co.uk/hubfs/Product%20Guides/Fourthline%20%20Operational%20Resilience%20Diagnostic.pdf) ###### Start a conversation ## Start a Conversation with Fourthline Schedule a meeting [![footerLogo](https://www.thefourthline.co.uk/hubfs/footerLogo.svg)](https://www.thefourthline.co.uk) Specialist Operational Resilience & Regulatory Risk Consulting - - - - Book a Call - About - [Insights](https://www.thefourthline.co.uk/blog) - [About](https://www.thefourthline.co.uk/about) - [Contact](https://www.thefourthline.co.uk/contact) - Solutions - [What we do](https://www.thefourthline.co.uk/solutions/what-we-do) - [Operational Resilience](https://www.thefourthline.co.uk/solutions/operational-resilience-bcm) - [Third Party Risk Management](https://www.thefourthline.co.uk/solutions/third-party-risk-management) - [ICT & Technology Resilience](https://www.thefourthline.co.uk/solutions/ict-technology-resilience) - [Cyber Resilience](https://www.thefourthline.co.uk/solutions/cyber-resilience) - How We Work - [Diagnostic Assessment](https://www.thefourthline.co.uk/how-we-work/diagnostic-assessment) - [Annual Resilience Retainer](https://www.thefourthline.co.uk/how-we-work/annual-resilience-retainer) - [Managed Services](https://www.thefourthline.co.uk/how-we-work/managed-services) - Sectors - [Insurance](https://www.thefourthline.co.uk/sectors/insurance) - [Banking](https://www.thefourthline.co.uk/sectors/banking) - [Investment Management](https://www.thefourthline.co.uk/sectors/investment-management) © FourthLine Ltd 2026 All rights reserved. [Privacy Policy](https://www.thefourthline.co.uk/privacy-policy) Terms ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Daniel Waltham", "url" : "https://www.thefourthline.co.uk/blog/author/daniel-waltham" }, "dateModified" : "2023-10-02T16:11:58.041Z", "datePublished" : "2023-10-02T16:11:58.000Z", "headline" : "Navigating Third-Party Risk Management: Roles and Responsibilities", "image" : [ "https://www.thefourthline.co.uk/hubfs/231002%20TPRM-Video-blog-1.jpg" ], "mainEntityOfPage" : { "@id" : "https://www.thefourthline.co.uk/blog/tprm-roles-responsibilities-1", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.thefourthline.co.uk/hubfs/230714-Fourthline-new-master-Logo-1.jpg" }, "name" : "Fourthline" } } ```