Third-party risk reporting in financial services: navigating the need for greater insight
November 2023
Risk management of third-party arrangements by regulated firms remains a critical priority for financial services regulators, and is a key component of the operational resilience agenda.
Increasingly, firms are required to report information about their operational exposure to their third parties directly to regulators. Recent regulatory reporting exercises, such as the PRA’s Outsourcing Register submission, have shone a light on the difficulty many firms still have in being able to report accurate and timely information about their third-party arrangements.
But this challenge extends beyond regulatory reporting obligations: accurate and timely management information about third-party risk is critical to allow senior management to demonstrate that they are discharging their obligations to oversee their external providers. Without it, risks may go unaddressed and serious failures occur as a result.
In this article, we look at seven key challenges regulated firms face in achieving effective third-party risk reporting for both their internal and external stakeholders, and consider what can be done in response.
Fragmented system and data landscape
Effective third-party risk management (TPRM) requires the synthesis of data that is typically stored in systems including sourcing, finance and TPRM. Often the existing data architecture does not support easy integration of data from these fragmented sources.
Two challenges are particularly noteworthy:
- The 'supplier' view: Third-party arrangements are recorded in systems either by supplier, by contract, or by service. Different systems record one or more of these elements as their primary key, but there is no consistent and reliable mapping between the three elements.
- The ‘consumer’ view: Across a group, third-party services are consumed by different legal entities and business units. There is no systematic record of who consumes what, which hinders both the production of effective management information for business units and the ability to report by legal entity to regulators.
Addressing these challenges does not necessarily entail extensive investment in tooling and re-architecting of the systems landscape, but where such investment is underway it should account for these objectives. In the absence of such investment, firms can develop mappings between suppliers, contracts, services and consumers, but must implement strong maintenance controls for these.
Inaccurate or missing data
Data held about third-party arrangements can be dated, patchy or inaccurate, preventing reliable reporting. Often, many of the attributes that regulators now require to be reported were never collected in the first place. Rolling review or contract renewal programmes may partly address this challenge, but some third-party arrangements sit outside these reviews, or are evergreen contracts that are never subject to renewal.
Issues with data quality can be remediated at the same time as broader third-party risk remediations, for example when these are undertaken to uplift contract compliance or implement business continuity and exit plans. Alternatively, standalone data remediation initiatives can be undertaken to improve the quality of data. However it is achieved, it is critical to address existing data quality issues if risk reporting is going to be reliable.
Maintenance of data quality
One-off data remediation exercises can only improve data quality on a temporary basis. Without ongoing and effective data governance, data quality will quickly deteriorate again, undermining the investment in remediation and preventing reliable reporting.
Ownership definition for data relevant to TPRM has often been neglected, resulting in a lack of accountability for ongoing maintenance. Likewise, data quality controls may not be effective, meaning changes in arrangements are not reflected in the data.
Most firms will have a group-wide data quality framework but without this having been applied to TPRM data and systems. Doing so is an important step towards sustaining the quality of the information required by senior management and regulators alike. Firms can also seek better integration between their TPRM systems and their enterprise technology, enabling seamless access management and ownership definition to support better data quality controls.
Meaningful management information
For senior management to be able to properly oversee third-party risk and so discharge their regulatory obligations, raw data on third-party arrangements must be translated into meaningful management information that gives real insight into the level of risk. This management information should be designed with due regard to the regulatory expectations over TPRM.
Firms are developing increasingly sophisticated suites of TPRM metrics that can be used by senior management for this oversight. Data trending can be used to spot changes in the risk profile, and enrichment of internal data using information data sources can increase the depth of insight and deliver early warning capability. This can be integrated with reporting on supplier service and performance data, allowing deterioration of service to be used as a key indicator of overall risk.
Senior management need to be able to demonstrate that they are proactive in their management of third-party risk, and improved management information is a significant tool to enable this.
Organisational challenges
Addressing data challenges and leveraging data to improve reporting requires teams to have appropriate systems and data skill sets, which can often be in short supply in traditional TPRM functions. Likewise, there may be cultural or organisational blockers that prevent successful remediation of issues and improvements in reporting quality.
Firms that tackle these issues directly through investment and education are best positioned to take advantage of the benefits that improved data quality and reporting capabilities can bring. Where organisational change programmes are planned or underway, they must take account of the need for these skill sets and appropriately prioritise them.
New regulatory requirements for operational resilience
Recent UK regulatory exercises have explicitly required firms to report which third-party arrangements support which important business services as defined by the firm’s operational resilience framework. Many firms have had to enrich this data manually for reporting purposes as they do not currently have any systematic mapping between their third-party arrangements and their operational resilience framework. These requirements are only likely to grow in future as other operational resilience regulations - such as the EU Digital Operational Resilience Act - come into force.
This is a key area in which better use of data will prove beneficial. Firms that seize the opportunity to integrate their TPRM data and reporting with their operational resilience framework in the near future will be better positioned to respond to these increasing regulatory asks, as well as benefiting from enhanced operational resilience.
Future readiness
One of the most common inquiries we receive currently concerns the future of TPRM: how can firms make use of predictive analytics and generative AI to achieve higher-quality insights in their management of third-party risk?
It is undoubtedly the case that these new technologies will allow for powerful approaches to be employed, but unless the quality of underlying internal data is addressed, the scope to generate meaningful insight will be severely limited. Firms can act now to ensure that they are in the best possible position to realise the benefits new technologies will bring, at the same time as they ensure they meet the baseline regulatory expectation.
Where next?
This is an area that many regulated firms are grappling with, as weaknesses in legacy TPRM data appear commonplace and investment in systems has not kept pace with requirements.
As the regulatory focus on third-party risk reporting grows, firms cannot afford to leave these challenges unaddressed.
Related Content
Contact us
Follow us
