What is Third-Party Risk?
The short answer
Third-party risk is the exposure created by a relationship with an external organisation or person.
Third-Party Risk: why it matters
A risk decision depends on the relationship, exposure and the age and scope of available information. This concept supplies one part of that assessment, not a universal approval rule.
How to assess it in practice
Define the relationship’s financial, operational and compliance risks instead of collapsing them into one undocumented label. Start by defining the question the team needs to answer. Identify the relevant record or evidence, check its scope and date, and retain the reasoning behind the result. If evidence conflicts, keep that conflict visible for review.
Worked example
Illustrative workflow: a team reviewing a business adds a separate check for third-party risk. The reviewer’s task is to define the relationship’s financial, operational and compliance risks instead of collapsing them into one undocumented label. The outcome is recorded together with the supporting evidence; an unresolved question stays open rather than being converted into a positive result.
A supplier is financially stable but operates a service essential to payments. Review operational and security dependencies alongside the credit assessment.
Distinctions that matter
Third-Party Risk belongs to the third-party exposure topic family. Read Supplier Risk alongside it to understand the adjacent question. Each page has its own intended scope; shared context does not make the concepts equivalent.
Evidence and review output
Review these
- Relationship and critical service
- Legal and financial exposure
- Shared dependencies and locations
The review should produce
A relationship-specific risk assessment with prioritised controls and an accountable review owner.
Across this family
Risk arises from the relationship and the harm a failure could cause. Combine legal identity with service criticality, financial exposure and relevant dependencies. A supplier's low spend or familiar incorporation country can hide a substantial operational or geographic concentration.
A note from practice
Third-party risk should be tied to the service, dependency and potential harm created by the relationship. The same company can require different controls as a minor vendor and as a critical infrastructure provider.
Limits and common mistakes
The practical boundary is important: Define the relationship’s financial, operational and compliance risks instead of collapsing them into one undocumented label. Do not substitute a related label for this check or assume that missing information is a negative finding. Source-specific and jurisdiction-specific rules require their own review.
Frequently asked questions
Which evidence should I review?
How is Third-Party Risk different from Supplier Risk?
What should the result of the review contain?
Continue learning
Related topics
- Third-party exposureSupplier RiskSupplier risk concerns the potential disruption or loss associated with a supplier relationship.
- Third-party exposureCounterparty RiskCounterparty risk is the risk that the other party fails to fulfil relevant obligations in a transaction or relationship.
- Third-party exposureCountry RiskCountry risk concerns factors associated with a country that can affect a relationship or transaction.
See the registry record behind every answer.
Primary, government-sourced data on 600M+ companies in 200+ countries, with full source attribution.