4th Party Risk: Effective Visibility

Organizations increasingly depend on third parties for technology, logistics, professional services, data processing and critical infrastructure. Consequently, third-party risk management has become an established component of enterprise risk management.

Yet a less visible problem is emerging: fourth-party risk. A fourth party is a supplier or service provider upon which an organization's direct vendor depends. The organization may have a sophisticated due-diligence process for its immediate supplier while having little visibility into the dependencies supporting that supplier's service.

This creates an important distinction between contractual visibility and operational visibility. A cloud provider may rely on another infrastructure provider. A software company may depend on open-source libraries. A payment processor may rely on telecommunications, datacenter and cybersecurity providers. A logistics provider may depend upon subcontractors that the original customer never directly assessed.

The resulting risk is systemic rather than merely contractual. A disruption several layers removed from the organization can still interrupt a critical business service. ERM professionals should therefore begin asking three questions: What are our critical dependencies? Where are the concentration points? What happens if a critical dependency becomes unavailable?

The appropriate response is not necessarily to investigate every supplier indefinitely. Rather, organizations should apply a risk-based dependency-mapping approach, concentrating deeper analysis on services that are critical to strategic objectives or operational continuity.

The objective is not perfect visibility. It is visibility useful for effective decision making. It’s not about producing larger risk registers, but rather producing better decisions about where the organization is dependent, where it is exposed and where it needs greater optionality.