Third-Party Risk Management: New Expectations

Supervisory expectations for third-party and outsourcing risk management continue to sharpen, particularly around firms' ability to evidence ongoing oversight of outsourced functions rather than relying on point-in-time due diligence at contract signing.

This is a pattern we've addressed directly in client engagements: outsourcing contracts frequently specify what a provider does without clearly specifying which internal role remains accountable for ongoing oversight, an ambiguity that tends to surface only when something goes wrong.

We recommend firms with material outsourcing arrangements conduct a control-ownership mapping exercise now, assigning a named internal owner for oversight of every outsourced function, ahead of increased supervisory testing in this area.

This briefing reflects Alden Advisory's general commentary on a developing regulatory topic and is not legal or regulatory advice. Firms should seek specific guidance for their own circumstances.