Outsourced does not mean externally owned
The customer, supervisor, and board will often experience a vendor failure as the firm's failure. The weekly brief should make that accountability visible.
Signals / Third-party risk
Dependencies that look internal when they fail
The exploded third-party page behind the weekly brief. It translates vendor, model-provider, cloud, processor, and outsourcing signals into ownership and evidence questions.
Supporting evidence
Ten further third-party signals
The shortlist above carries the leadership read. These ten additional rows link external signals to the dependency questions they create for procurement, resilience, technology, and risk owners.
- 06
Agentic AI suppliers create permission and audit-log questions
- 07
Enterprise AI features can enter production through existing tools
- 08
Fourth parties can carry the real operational dependency
- 09
Regulatory notification paths should include vendor-originated incidents
- 10
Concentration risk should be aggregated across business lines
- 11
Outsourced complaints and remediation can become conduct exposure
- 12
Data processors need lineage, return, deletion, and subcontracting evidence
- 13
Vendor AI guardrails need technical controls outside the prompt
- 14
Exit plans need migration windows, data return, and workaround detail
- 15
Board packs need a single view of critical third-party exposure
Why it made the weekly brief
The editorial judgement
Third-party risk matters when the external provider effectively becomes part of the firm's control environment, customer journey, or regulatory evidence base.
Procurement, technology, resilience, legal, compliance, data, and business owners
Third-party risk cuts across contract terms, control assurance, incident response, data lineage, exit planning, and customer impact.
Criticality, ownership, concentration, control rights, and exit practicality
Good assurance should show who owns the dependency, what rights exist, what evidence is available, and how the firm would operate during failure.
Control evidence checklist
What the reader should ask for
This checklist gives a third-party or resilience owner enough prompts to test the current evidence pack.
- Which providers support important business services, regulated activities, customer journeys, or control evidence?Map
- Who is the accountable internal owner for each provider, and who owns the failure response?Govern
- Are audit, information, incident, data return, subcontracting, and exit rights contractually clear and practically usable?Legal
- What evidence proves the provider's control is operating, and how fresh is it?Assure
- Could the firm exit, substitute, degrade gracefully, or operate manually within the tolerance window?Recover
Archive and source trail
How this topic should compound over time
Third-party risk is cumulative: the value comes from seeing repeated dependency patterns across providers, services, and regulatory expectations over time.
Processors, model providers, and AI tools
Included in weekly signals and control lessons.
Provider incidents, regulatory expectations, and assurance signals
The weekly brief carries the linked sources used to build this dependency view.
EBA outsourcing guidelines
Use as the standing reference for material outsourcing, exit, audit rights, and notifications.