[OR] [MAS] [E2] [C7] Third-Party Risk Management

eBook 2: Chapter 7

Third-Party Risk Management

Introduction

Third-Party Risk Management (TPRM) has become a critical pillar of operational resilience,   particularly as financial institutions increasingly rely on external vendors, service providers, and technology partners to deliver their Critical Business Services (CBS).

In Singapore, the Monetary Authority of Singapore places strong emphasis on the effective management of outsourcing and third-party risks as part of its broader operational resilience framework.

Aligned with MAS guidance in “Achieving Operational Resilience for Financial Institutions in Singapore” and its outsourcing guidelines, institutions must ensure that outsourcing arrangements do not compromise service continuity, customer outcomes, or systemic stability.

Complementing this, BCM Institute identifies third-party risk management as a core component of operational resilience, highlighting the need to manage dependencies beyond organisational boundaries.

This chapter explores outsourcing risks, vendor resilience assessment, and alignment with MAS outsourcing guidelines.

Outsourcing Risks

The Growing Dependency on Third Parties

Financial institutions today rely on third parties for a wide range of services, including:

• Cloud computing and data hosting
• Payment processing and transaction services
• IT support and cybersecurity services
• Customer-facing digital platforms

While outsourcing enhances efficiency and innovation, it also introduces new risk dimensions that can directly impact CBS delivery.

Types of Outsourcing Risks

Aligned with BCM Institute’s classification of third-party risks, key risk categories include:

Operational Risk

Failure of a vendor to deliver services due to system outages, process failures, or capacity constraints.

Technology and Cyber Risk

Cyberattacks or vulnerabilities within third-party systems can compromise data integrity or service availability.

Concentration Risk

Over-reliance on a single or limited number of providers (e.g., major cloud service providers), increases systemic vulnerability.

Compliance and Regulatory Risk

Failure of vendors to meet regulatory requirements potentially exposes the financial institution to penalties.

Geopolitical and Location Risk

Disruptions arising from political instability, natural disasters, or cross-border regulatory issues affecting vendor operations.

Reputational Risk

Negative impact on customer trust due to third-party failures or misconduct.

Impact on Critical Business Services

Outsourcing risks are particularly significant because they can:

• Disrupt end-to-end service delivery
• Create hidden dependencies not fully visible to the institution
• Amplify the impact of disruptions through cascading failures

MAS expects institutions to identify and manage these risks as part of their service-centric operational resilience approach.

Vendor Resilience Assessment

Moving Beyond Traditional Vendor Assessment

Traditional vendor management focuses on cost, performance, and contractual compliance. However, operational resilience requires institutions to assess whether vendors can withstand and recover from disruptions.

Key Components of Vendor Resilience Assessment

Business Continuity and Disaster Recovery (BC/DR) Capability

• Does the vendor have robust BC/DR plans?
• Are recovery time objectives (RTO) and recovery point objectives (RPO) aligned with the institution’s CBS requirements?
• Are these plans regularly tested?

Operational Resilience Maturity

• Does the vendor adopt a structured resilience framework?
• Are critical services identified and protected?

Technology and Cyber Resilience

• Are cybersecurity controls aligned with industry standards?
• How does the vendor detect, respond to, and recover from cyber incidents?

Dependency and Subcontracting Risk

• Does the vendor rely on subcontractors?
• Are fourth-party risks identified and managed?

Incident and Crisis Management Capability

• Can the vendor respond effectively to incidents?
• Are escalation and communication protocols clearly defined?

Testing Vendor Resilience

Vendor resilience should not be assumed—it must be validated through testing, including:

• Participation in joint scenario testing exercises
• Simulation of third-party failures
• Testing of failover and contingency arrangements

This aligns with MAS expectations for end-to-end testing of CBS, including third-party dependencies.

Continuous Monitoring

Vendor resilience assessment is not a one-time activity. Institutions must implement:

• Ongoing performance monitoring
• Periodic risk reassessments
• Regular audits and reviews

This ensures that third-party risks are continuously managed in a dynamic risk environment.

Alignment with MAS Outsourcing Guidelines

Overview of MAS Expectations

The Monetary Authority of Singapore outsourcing guidelines set out clear expectations for financial institutions to manage outsourcing risks effectively.

These guidelines apply to all material outsourcing arrangements and are closely linked to operational resilience requirements.

Key Principles of MAS Outsourcing Guidelines

Board and Senior Management Responsibility

• The Board retains ultimate accountability for outsourced activities
• Senior management must ensure effective oversight and governance

Due Diligence and Risk Assessment

• Institutions must conduct comprehensive due diligence before engaging vendors
• Risk assessments must consider operational, financial, legal, and reputational factors

Outsourcing Agreements

• Contracts must clearly define roles, responsibilities, and service levels
• Include provisions for business continuity, audit rights, and termination

Business Continuity and Resilience

• Vendors must have robust BC/DR capabilities
• Institutions must ensure that outsourcing arrangements support CBS continuity

Monitoring and Control

• Ongoing monitoring of vendor performance and risk exposure
• Regular reviews and audits of outsourcing arrangements

Exit and Contingency Planning

• Institutions must have exit strategies to manage vendor failure or termination
• Ensure minimal disruption to CBS during transition

Recent Updates and Regulatory Focus

MAS circulars and updates (e.g., ID 19/23) reinforce the need for:

• Enhanced oversight of critical outsourcing arrangements
• Stronger focus on technology and cloud outsourcing risks
• Greater emphasis on resilience and recoverability

These updates reflect MAS’s recognition that third-party dependencies are a key vulnerability in the financial ecosystem.

Integrating TPRM into Operational Resilience

Third-party risk management must be fully integrated into the operational resilience framework:

Link to CBS Identification

Dependency Mapping

Impact Tolerance Alignment

Scenario Testing Inclusion

Include third-party failure scenarios in testing exercises.

Continuous Improvement

Use testing outcomes to enhance vendor management strategies.

This integration ensures that third-party risks are managed holistically and proactively, rather than reactively.

Third-Party Risk Management is a fundamental component of operational resilience in Singapore’s financial sector.

Guided by the expectations of the Monetary Authority of Singapore and aligned with BCM Institute’s framework, financial institutions must move beyond traditional outsourcing management to adopt a resilience-focused approach.

By understanding outsourcing risks, conducting robust vendor resilience assessments, and aligning with MAS outsourcing guidelines, organisations can ensure that their third-party dependencies do not become points of failure.

Instead, they become integrated and resilient components of the overall service delivery ecosystem, enabling institutions to maintain continuity and trust even in times of disruption.

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.