{"id":21518,"date":"2022-09-20T06:00:46","date_gmt":"2022-09-20T05:00:46","guid":{"rendered":"https:\/\/davies-group.com\/consulting\/blog\/third-parties-the-solution-or-the-achilles-heel\/"},"modified":"2026-01-23T12:03:40","modified_gmt":"2026-01-23T12:03:40","slug":"third-parties-the-solution-or-the-achilles-heel","status":"publish","type":"blog","link":"https:\/\/davies-group.com\/consulting\/blog\/third-parties-the-solution-or-the-achilles-heel\/","title":{"rendered":"Third Parties \u2013 Solution or Achilles heel?"},"content":{"rendered":"

Third party providers or Outsourced Service Providers (OSP), have become a critical component of a firm\u2019s operating model and over a number of years this criticality has increased as more services are outsourced. While OSPs may have a level of responsibility to you (if they supply services to you), it is vital to remember that your clients are YOUR clients – not the third party’s clients. It may be a chain, but your firm bears responsibility for and accountability to the client, not the OSP, no matter what is written into a contract.<\/p>\n

If a client can\u2019t get money out of their ISA and they need it urgently, it will be you they blame, not the OSP. While firms can outsource activities<\/em>, they cannot outsource the accountability of Operational Resilience. And regulators are absolutely clear on this fact. Be under no disillusion a contract is going to direct the regulator to the OSP, they are coming after the firm.<\/p><\/blockquote>\n

A simple way to think about the relationship between an organisation and its OSP, is that an organisation is only as strong as its weakest provider.<\/strong> And it doesn\u2019t matter how large that OSP is. When an OSP delivers key parts of your service, if a disruption to their service could impact one of your important business services, you must be comfortable with their resilience.<\/p>\n

But this regulation is new for OSPs too. It\u2019s important that you build a relationship of strength and involve the OSP in your Operational Resilience programme at the earliest possible stage and on-going. This should not become a \u201cthem and us\u201d exercise. It is about working closely and in tandem to reach the best outcome for clients and the market. Our clients are often using our OSP framework to ensure close alignment of objectives and monitoring of service and progress.<\/p>\n

Another consideration is the fact that while there will be contracts in place with some of your OSP’s third parties, this will not be the case for all. While some will be a supplier to your organisation, others may be firms you rely upon but where there is no contract in place to fall back on. Relationships with these organisations are also critical so, again, it is important to engage and build a relationship of trust with key contacts as soon as you can.<\/p><\/blockquote>\n

Firms also need to build OSPs into their Operational Resilience framework. Firms must map the processes, technology, information, people, and facilities that are critical to the delivery of their important business services. But firms should also look to map their third parties and be clear on where interactions occur, and threats exist. This may already be undertaken as part of a business\u2019s wider OSP Management framework although ultimately, firms need to know what parts of their services touch which OSPs – and critical fourth parties, where appropriate too.<\/p>\n

Within the sector a number of firms will use the same OSP. This appears fine from the perspective of service alignment, but in reality, it can create a concentration risk that all firms should seek to discuss and address with the OSP.\u00a0 In reality, OSPs should actively seek this alignment in any case, as it will facilitate single solutions and therefore potentially reduce cost for the OSP.<\/p>\n

Our advice is that firms can begin to develop the management of third parties by:<\/p>\n