[OR] [Pillar] [E4] [C4] TPRM Governance and Operating Model

eBook 4: Chapter 4

TPRM Governance and Operating Model

Introduction

An effective Third-Party Risk Management (TPRM) framework cannot function without strong governance and a clearly defined operating model. As third-party dependencies grow in scale and criticality, organisations must ensure that accountability, oversight, and decision-making are well structured across all levels.

Regulators such as the Bangko Sentral ng Pilipinas (BSP) and Bank Negara Malaysia (BNM) emphasise that financial institutions remain fully accountable for risks arising from outsourcing and third-party arrangements. 

This requires a governance model that integrates TPRM into enterprise risk management, Operational Resilience, and business operations.

This chapter outlines how to establish a robust TPRM governance structure, including roles and responsibilities (RACI), the Three Lines of Defence model, and an organisational operating model.

Purpose of This Chapter

This chapter provides a structured approach to designing and implementing TPRM governance. By the end of this chapter, readers will:

• Understand governance principles for TPRM
• Apply the Three Lines of Defence (3LoD) model
• Define roles using a RACI framework
• Design an effective TPRM organisational structure
• Align governance with Operational Resilience and regulatory expectations

Governance Principles for TPRM

A strong TPRM governance model should be built on the following principles:

1. Accountability

The organisation retains full accountability for third-party risks—even when services are outsourced.

2. Risk Ownership

Business units owning third-party relationships must also own the associated risks.

3. Independent Oversight

Risk and compliance functions must provide independent challenge and review.

4. End-to-End Visibility

Governance must cover the entire third-party lifecycle and supply chain (including fourth parties).

5. Integration with Operational Resilience

TPRM must be embedded into:

• Critical Business Services (CBS)
• Business Impact Analysis (BIA)
• Scenario Testing
• Crisis Management

The Three Lines of Defence (3LoD) Model

The Three Lines of Defence model provides a clear structure for managing and overseeing third-party risks.

Table: TPRM Roles under the Three Lines of Defence

👉 Key Insight:

• First Line = Own the risk
• Second Line = Oversee and challenge the risk
• Third Line = Assure the risk management process

RACI Matrix for TPRM

A RACI (Responsible, Accountable, Consulted, Informed) matrix ensures clarity of roles across the TPRM lifecycle.

Template: TPRM RACI Matrix

Legend:

• R = Responsible (executes task)
• A = Accountable (ultimate ownership)
• C = Consulted (provides input)
• I = Informed (kept updated)

TPRM Organisational Structure

Recommended Operating Model

A centralised or hybrid model is typically most effective for banks.

Table: TPRM Organisational Structure

TPRM Governance Committees

Example: TPRM Governance Committee Structure

Policy and Standards Framework

Key TPRM Policies

Integration with Operational Resilience

Table: Governance Alignment with OR Components

Escalation and Reporting Framework

Template: TPRM Risk Escalation Matrix

Key Success Factors

• Clear ownership and accountability across all lines
• Strong central coordination (TPRM function)
• Effective cross-functional collaboration
• Integration with Operational Resilience and BCM
• Continuous training and awareness

Key Takeaways

• Governance is the foundation of effective TPRM
• The Three Lines of Defence ensure proper oversight
• A RACI model eliminates ambiguity in responsibilities
• A structured organisational model enables execution at scale
• Strong governance ensures compliance with BSP 1203 and BNM expectations

A well-defined governance and operating model is essential to ensure that Third-Party Risk Management is consistently applied, effectively monitored, and fully aligned with organisational objectives.

By establishing clear roles, responsibilities, and oversight mechanisms, financial institutions can manage third-party risks with confidence and accountability.

Embedding TPRM within the Three Lines of Defence, supported by a robust RACI framework and organisational structure, ensures that risks are not only identified but actively managed throughout the lifecycle.

When integrated with Operational Resilience, this governance model enables organisations to maintain the continuity of critical services—even in the face of third-party disruptions.

C1	C2	C3	C4
C5	C6	C7	C8

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.