Third-Party Risk and Controls Baselining for Bank Transformation

At a Glance

A third-party risk baseline maps vendors, services, data flows, and critical dependencies to assess inherent and residual risk, control effectiveness, concentration exposure, and resilience, enabling stronger oversight, prioritization, and regulatory alignment.

Why a third-party risk baseline is often required before scaling change

Bank transformations increasingly depend on external providers for cloud infrastructure, cyber tooling, data services, model components, and operational utilities. As that dependence grows, regulators evaluate whether the institution can demonstrate control of risk outcomes—not only that it has vendor processes. A third-party risk baseline is the fixed, auditable reference point that defines the bank’s third-party universe, criticality classification, control requirements, and evidence expectations at a point in time.

When that baseline is weak, scaling change creates compounding exposure: sub-vendor opacity, uneven contractual safeguards, inconsistent access controls, and fragmented monitoring. When the baseline is defensible, executives can sequence modernization with confidence, prove board-level oversight, and demonstrate that operational resilience is being strengthened rather than traded away for delivery speed.

The 2026 shift toward outcome-based third-party risk management

The 2026 posture for third-party risk management (TPRM) is moving away from reactive “document completion” toward lifecycle control and operational resilience. Supervisory expectations emphasize that third-party arrangements should be governed with risk discipline that is consistent with the bank’s own internal risk management standards, including clear accountability, measurable control effectiveness, and decision-grade evidence.

A practical implication for transformation governance is that TPRM cannot sit outside the portfolio. If material initiatives rely on third parties, the baseline must be integrated into approval, architecture, security, and go-live gates. Otherwise, third-party dependencies become hidden constraints that surface late as exam issues or operational incidents.

What must be baselined for an audit-friendly TPRM control environment

Executives need a baseline that is rigorous enough to withstand supervisory review, but operational enough to run at scale. In practice, an audit-friendly baseline answers five questions: who the third parties are, what the bank depends on them for, how the bank controls risk through the lifecycle, how the bank monitors outcomes, and how the bank exits safely.

1) Planning and inventory baselining

Planning is where most control failures are seeded. The baseline should establish a complete inventory of third-party arrangements, a consistent criticality and materiality model, and clear ownership. It must also make dependencies visible, including fourth and fifth parties and concentration exposure across providers and locations.

• Define criticality tiers and what “material” means for the institution’s risk appetite and resilience objectives
• Baseline sub-vendor disclosure expectations and mapping requirements
• Record location dependencies (data residency, delivery centers, hosting regions) to support jurisdictional risk management

2) Due diligence baselining

Modern due diligence must cover both traditional control domains and emerging risk categories. For 2026, that includes provider security posture, resilience capabilities, incident response readiness, and the governance of AI components provided as products or embedded services. Due diligence baselines should be evidence-based and proportionate, with explicit depth and frequency aligned to criticality.

• Set minimum evidence for cyber controls, resilience testing, and business continuity capabilities
• Include AI model governance, data handling practices, and explainability or transparency constraints where relevant
• Align reassessment cadence to risk change triggers (incidents, major subcontracting changes, or material service alterations)

3) Contracting baselining

Contract baselining translates risk requirements into enforceable rights and obligations. It should include clear service definitions, resilience metrics, audit and access rights, subcontracting controls, information protection requirements, and termination assistance. For transformation programs, contracting baselines must also support delivery reality: changes in scope, platform migrations, and parallel cutovers create contract stress that exposes weak clauses.

• Baseline audit rights, data access rights, and evidence production obligations that support exam requests
• Define subcontracting and change notification terms so material changes do not occur without governance
• Require secure access patterns and align vendor access to zero-trust principles where systems access is required

4) Monitoring baselining

Monitoring is where outcome-based TPRM becomes visible. A baseline should define what the bank monitors, how often, with what thresholds, and how issues are escalated. For high-criticality services, monitoring must cover both security and resilience signals, and it must be capable of detecting deterioration before it becomes customer impact or regulatory breach.

• Baseline key risk indicators and key performance indicators that link third-party performance to critical services
• Set expectations for continuous assurance where appropriate (e.g., control attestation, vulnerability reporting, incident notifications)
• Define how third-party issues flow into enterprise issue management and remediation governance

5) Termination and exit baselining

Termination planning is frequently the weakest area and one of the most scrutinized during resilience discussions. Baselining should include exit strategies, data return and deletion requirements, transition support, and tested playbooks for substitution or service migration. The baseline should also acknowledge operational constraints: exits are rarely clean, and executives need decision criteria for when risk triggers justify acceleration.

• Baseline exit feasibility by service criticality and define minimum viable alternatives
• Require termination assistance provisions and practical data portability mechanisms
• Define triggers for exit governance, including repeated control failures, material breaches, or concentration risk escalation

2026 risk priorities that must be visible in the baseline

Third-party baselining must reflect the risk landscape the bank is actually operating in. For 2026, the recurring priorities are visibility, access control, and resilience under stress, especially as technology estates become more distributed and supplier ecosystems more complex.

• AI provided by third parties: inventory AI-dependent services, define evidence for model governance and data handling, and ensure accountability for monitoring and change control
• Sub-vendor visibility: map critical subcontractors and enforce notification and approval requirements for material changes
• Location-specific risk: baseline where services run and where work is performed, including geopolitical, legal, and operational disruption exposure
• Zero-trust access for vendors: define identity, least-privilege access, session controls, monitoring, and recertification requirements for any supplier with system access
• Operational resilience outcomes: connect third-party controls to critical service mapping, recovery objectives, and tested response playbooks

Translating third-party risk into executive decisions

Baselining only creates governance value if it changes decisions. Executives should expect the baseline to produce decision-grade outputs: concentration exposure by critical service, budget and capacity implications of monitoring requirements, and quantified downside scenarios that support prioritization. Emerging practices such as cyber risk quantification and workflow automation can help convert control data into financial terms and shorten the time from signal to action.

Some organizations also track broader indicators of sector capacity and cost absorption for TPRM tooling and operating model changes. Where such indicators are used, they should be treated as context rather than as a substitute for institution-specific baseline evidence about control effectiveness and resilience outcomes.

Building an objective third-party risk baseline to track progress over time

Because third-party ecosystems change continuously, a baseline must be maintained as a controlled reference point rather than as a one-time snapshot. Progress should be measurable through reductions in unclassified suppliers, improved sub-vendor mapping coverage, faster remediation cycle times, higher quality contract clauses for critical services, and improved resilience test results linked to external dependencies.

When banks treat TPRM baselining as a transformation enabler, the portfolio benefits are immediate: initiative plans become more realistic, go-live risk decreases, and the institution can demonstrate consistent governance behavior under supervisory scrutiny. This is especially important when change programs span jurisdictions with differing regulatory expectations and when critical services rely on a small number of systemic providers.

Using maturity evidence to set and govern a third-party risk baseline

A maturity assessment strengthens third-party baselining when it tests the same failure modes that undermine resilience: inconsistent governance, weak evidence production, fragmented monitoring, and poor linkage between third-party controls and critical services. Executives can use maturity dimensions such as governance effectiveness, delivery execution, architecture and data readiness, risk and control integration, and operational resilience to validate that third-party dependencies are being governed as part of transformation—not as an administrative afterthought.

Applied in this way, the DUNNIXER Digital Maturity Assessment can support leadership in evaluating baseline readiness, sequencing remediation versus scaling change, and increasing confidence that third-party risk controls will remain effective as the portfolio expands and operational complexity grows.

References

• https://finreg.aoshearman.com/bcbs-principles-for-the-sound-management-of-third-party-risk#:~:text=The%20Basel%20Committee%20on%20Banking,risk%20discipline%20as%20external%20TPSPs.
• https://www.fdic.gov/news/press-releases/2023/pr23047.html#:~:text=The%20final%20guidance%20describes%20principles,guidance%20released%20in%20July%202021.
• https://www.deloitte.com/uk/en/services/consulting/blogs/2025/eba-consultation-paper-draft-guidelines-on-the-sound-management.html#:~:text=Ultimately%2C%20the%20EBA's%20proposed%20updates,turn%20strengthening%20your%20operational%20resilience.&text=1.,arrangement%20with%20a%20financial%20entity.
• https://bridgeforce.com/insights/third-party-risk-management-in-2026/#:~:text=The%20financial%20institutions%20that%20thrive,Contact%20us%20today.
• https://safe.security/resources/blog/2026-guide-to-third-party-risk-management-tprm/#:~:text=A%20third%2Dparty%20risk%20assessment,vendors%20receive%20lighter%2Dtouch%20reviews.
• https://www.processunity.com/resources/blogs/third-party-risk-maturity-gap-research/#:~:text=Closing%20the%20Gap,get%20your%20data%20questions%20answered.
• https://www.tprassociation.org/post/2026-tprm-state-of-the-industry#:~:text=Third%20Party%20due%20diligence%20must,handling%20practices%20in%20AI%20workflows.
• https://www.forvismazars.com/jp/en/insights/global-insights/top-10-risks-for-financial-services-firms-in-2026#:~:text=Regulatory%20landscape%20and%20key%20developments,%2C%20mapping%2C%20and%20response%20capabilities.
• https://www.morganlewis.com/blogs/sourcingatmorganlewis/2025/08/eba-proposes-extending-outsourcing-requirements-to-all-third-party-arrangements#:~:text=The%20European%20Banking%20Authority%20(EBA,those%20requirements%20introduced%20under%20DORA.
• https://www.linkedin.com/pulse/eba-expands-third-party-risk-management-closing-gap-beyond-rihae#:~:text=Implementation%20Timeline,mirroring%20DORA's%20register%20of%20information.
• https://www.ncontracts.com/nsight-blog/first-second-third-fourth-and-fifth-parties-how-to-measure-the-tiers-of-risk#:~:text=Third%2Dparty%20risk.,may%20present%20third%2Dparty%20risk.
• https://www.deloitte.com/lu/en/our-thinking/future-of-advice/preparing-third-party-risk-management.html#:~:text=The%20EBA%20Draft%20Guidelines%20on,conditions%20applying%20to%20such%20subcontracting.
• https://www.jdsupra.com/legalnews/2025-wrap-up-of-supervisory-changes-at-4769031/#:~:text=On%20October%206%2C%20the%20OCC,%2C%20complexity%2C%20and%20risk%20profile.
• https://www.globalfinregblog.com/2025/10/us-banking-regulators-propose-to-refocus-supervision-on-material-risks-and-eliminate-use-of-reputation-risk/#:~:text=March%2020%2C%202025:%20the%20OCC,the%20basis%20of%20reputational%20risk.%E2%80%9D
• https://www.linkedin.com/posts/chandni-trehan-saluja-32b76428_the-joint-forum-paper-on-outsourcing-in-activity-7405126582849155072-0Joj#:~:text=%F0%9F%91%89%20Key%20elements%20include:%20%E2%97%BE,range%20of%20third%2Dparty%20arrangements.
• https://panorays.com/blog/third-party-risk-management/#:~:text=To%20address%20this%2C%20mature%20TPRM%20programs%20follow,build%20a%20more%20resilient%20third%2Dparty%20security%20strategy.
• https://www.fortressinfosec.com/blog/navigating-the-eu-regulatory-framework-for-third-party-risk-management#:~:text=Practical%20Implications%20for%20TPRM%20Programs%20To%20comply,mature%20their%20TPRM%20functions.%20Key%20actions%20include:
• https://www.financierworldwide.com/fresh-linking-tprm-across-the-supply-chain#:~:text=Understanding%20all%20relevant%20types%20of%20risk%20is,third%20parties%20makes%20an%20organisation%20more%20vulnerable.
• https://www.americanbanker.com/payments/news/banks-get-new-federal-guidance-on-ai-cyber-risks#:~:text=For%20example%2C%20banks%20must%20verify%20the%20integrity,to%20data%20provenance%20guidelines%20in%20the%20draft.
• https://internationalbanker.com/banking/innovation-amid-instability-uk-banks-responses-to-the-risk-landscape-in-2024/#:~:text=Third%2Dparty%20risk%20management%20(TPRM):%20With%20regulatory%20pressures,significantly%20increasing%20their%20investments%20in%20TPRM%20solutions.
• https://www.shawdatasecurity.com/risk-managed-services#:~:text=Vendor%20Risk%20Management%20Companies%20that%20are%20subject,trusted%20partners%20that%20process%20sensitive%20company%20data.