Key risk indicator examples for third-party risk

Fourth party risk is the exposure one hop past your contract. Under the Interagency Guidance, due diligence covers "the volume and types of subcontracted activities and the degree to which the third party relies on subcontractors." DORA (Regulation (EU) 2022/2554, applying since 17 January 2025) is more direct: Article 30(2)(a) requires every ICT contract to state whether subcontracting of a critical or important function "is permitted and, when that is the case, the conditions applying to such subcontracting."

• No subcontractor or sub-processor list on file for a critical vendor.
• A list older than 12 months, or one contradicted by your ratings feed and contract notices.
• A critical subcontractor you learned about from the news, an incident or an invoice.

Count those gaps across Tier 1. A program might trigger at 10% of the tier with no current list, and at any single undisclosed critical subcontractor. Respond through the contract, using the notification clause the guidance recommends for "use of subcontractors, key personnel changes, or other business initiatives."

Concentration risk hides inside individually sound relationships. Each vendor passed diligence. Together, three of them run on the same cloud sub-processor in the same region, and one outage takes down payments, statements and the contact center at once. DORA Article 29(1) names two conditions to weigh before signing: a provider "that is not easily substitutable," and multiple critical arrangements "with the same ICT third-party service provider or with closely connected ICT third-party service providers." US guidance calls it "dependency on a single provider for multiple activities."

1. Map every critical function to its provider, that provider's key subcontractors and its delivery region.
2. Count the functions with no tested substitute.
3. Count the providers that appear under three or more critical functions.

Either count above zero is the trigger. Certa's guide to concentration risk in supply chains walks through the mapping in detail. DORA Article 28(8) sets the response: exit strategies for every ICT service supporting a critical or important function, so the entity can leave "without disruption to their business activities."

An sla breach is the most honest leading indicator you own, because the vendor reported it under contract. One missed availability target is noise. Twice in a quarter is a trend, and it tends to precede the larger failure. Performance measures in the contract, per the guidance, "can be used to monitor performance, penalize poor performance, or reward outstanding performance." DORA Article 30(2)(e) requires "service level descriptions" in every ICT contract.

Track two numbers: breaches per critical vendor per quarter, and repeats on the same SLA. Two breaches of one metric inside a rolling 90 days is a reasonable starting trigger, as is any single breach with customer impact. Feed the result into vendor scorecards & performance metrics so the business owner sees it, not only the risk team. Escalation runs from service credit, to a dated remediation plan, to the termination right the contract should already hold.

A finding with a passed due date and no new evidence is being tolerated, whatever the tracker says. Ongoing monitoring, per the guidance, escalates "material or repeat audit findings," and contracts should let you "require timely remediation" when issues surface. Repeat is the operative word. Examiners read a findings log looking for the same gap raised in two consecutive reviews.

Weight the count by severity and age. Any high-severity finding more than 30 days past its date is a sensible trigger, as is an overdue share above 20% of the open book. When it trips, go to the business owner with the remediation clause in hand and record the decision either way.

A documented risk acceptance with rationale is defensible. Silence is what gets written up.

Screening at onboarding answers one day's question. Lists change daily, and ownership changes without telling you. OFAC's 50 Percent Rule treats entities "directly or indirectly owned 50 percent or more in the aggregate by one or more blocked persons" as blocked themselves, so a vendor can become a sanctions problem through a shareholder you never screened.

Two measures matter here. Confirmed hits, where any one is a trigger. And the queue of unresolved alerts, measured in days to disposition, which is where programs drown. Certa's Adjudicate Agent makes "confidence-scored, explainable calls on sanctions and adverse media hits, so analysts stop chasing false positives," with the rationale logged against each disposition. Whatever tool you run, keep the human decision and the citation, because the regulator will ask why a hit was cleared and by whom.

Supplier failure is a slow signal that gets read late. On what to read, the guidance lists "audited financial statements, annual reports, and filings with the U.S. Securities and Exchange Commission," plus "pending litigation, unfunded liabilities, reports from debt rating agencies." It names "deterioration in financial condition" as an issue ongoing monitoring should escalate. DORA Article 29(2) adds insolvency: "duly consider the insolvency law provisions that would apply in the event of the ICT third-party service provider's bankruptcy."

Pull the signal from a data provider rather than an annual request for financials. For critical suppliers, a two-notch downgrade, a going-concern qualification or a commercial credit score crossing the program floor are reasonable triggers.

Respond with a contingency review: a second source, data escrow, step-in rights, and whether the exit plan in your DORA register would still work this quarter.

Every certificate of insurance, SOC 2 bridge letter, ISO 27001 certificate and professional license carries an expiry date, and most programs discover the lapse at the next annual review. On insurance, the guidance is specific: evaluating coverage "helps a banking organization determine the extent to which potential losses are mitigated," and contracts should fix the "amounts of insurance" a vendor must hold.

• Count by document type: COI, SOC 2 or SOC 1, ISO 27001, cyber coverage, and any license the service depends on.
• Count by tier, with critical vendors reported on their own.
• Example threshold: under 5% of the tier lapsed at month end.

This is one of the few KRIs that can hit zero and stay there. A renewal reminder 60 days ahead, plus a rule that an expired COI on a critical vendor blocks the next invoice, usually does it.

Governance, in the guidance, starts with "a current inventory of all third-party relationships." A shadow vendor lives in accounts payable, in an expense report or in single sign-on logs but nowhere in that inventory, so it was never tiered, screened or assessed.

Reconcile monthly. Match the vendor master and card spend against the inventory, then match SSO and OAuth app logs against it too, since a free SaaS tool with access to customer data is a third party whether or not anyone paid for it. Any unlisted vendor with system or data access is a trigger, as is unlisted spend above 2% of the total. Make the response an expedited intake rather than a reprimand, or the next one stays hidden.

Forced labor exposure became a customs problem in the United States on June 21, 2022, when the Uyghur Forced Labor Prevention Act's rebuttable presumption took effect. CBP presumes that goods "mined, produced, or manufactured wholly or in part" in the Xinjiang Uyghur Autonomous Region, or by an entity on the UFLPA Entity List, are barred from import under 19 U.S.C. 1307, and the importer carries the burden of rebutting it. Germany's Supply Chain Due Diligence Act (LkSG) has applied to companies with at least 1,000 employees since January 1, 2024, with a documented risk analysis, a complaints procedure and reporting among its obligations.

Count suppliers mapped to a high-risk region or a listed entity at every tier you can see, plus the share of in-scope suppliers with an overdue forced labor or ESG attestation. One entity-list link is a trigger. The attestation share is tunable, and 5% is a common starting point. Respond by tracing, then either clear the supply path with evidence or change the source.