Third-Party Due Diligence: Look Beyond the Questionnaire

Understand the service before scoring it

Third-party due diligence can become a collection of questionnaires whose answers are difficult to relate to real operational exposure. Begin with the service: what process depends on it, what data or access is involved, what could be interrupted, and how difficult would substitution or exit be? The same supplier can represent very different risk depending on how the institution uses it.

Evidence should be proportionate to the service and its consequences. A supplier statement may be a starting point, not independent assurance. Review the scope, period, exclusions, and relevance of available evidence; identify what is not covered; and consider whether additional testing, contract terms, or internal controls can address the gap. Avoid treating a single certification or report as proof that every control works for this arrangement.

Challenge across the relationship lifecycle

• Before selection: Assess business rationale, financial and operational capacity, security and privacy practices, subcontracting, geographic or concentration exposure, and exit feasibility as relevant.
• At contracting: Confirm service scope, responsibilities, incident communication, access to information, change notification, continuity expectations, audit or assurance arrangements, and termination or transition mechanisms appropriate to the service.
• During operation: Monitor service performance, incidents, control evidence, material changes, subcontractors, and action plans. Define triggers for reassessment and escalation.
• At exit: Plan data return or disposition, access removal, transition dependencies, knowledge transfer, and service continuity.

Evidence and reviewer questions

Retain the service map, assessment rationale, source evidence and limitations, risk decisions, contract controls, approvals, monitoring results, exceptions, and exit plan. Keep the connection between each identified risk and the response visible; a completed score alone does not explain whether the risk is acceptable.

• What would fail first if the provider became unavailable or changed its service?
• Does assurance evidence cover the service, locations, and period we rely on?
• Can we detect material subcontracting or control changes in time to respond?
• Is the proposed exit credible in practice, including data and operational dependencies?

Assign relationship and control owners, clarify who may accept residual exposure, and revisit diligence when the arrangement materially changes. Due diligence is a continuing judgment about dependency, evidence, and response—not a one-time procurement milestone.