Ask who owns a critical vendor and you will usually get three answers. Procurement signed it, InfoSec assessed it, and a business unit uses it every day. When that vendor has a breach, all three turn out to have been touching the relationship and none of them was accountable for it. Regulators have seen this often enough to write it down. In the Interagency Guidance on Third-Party Relationships (OCC, FDIC and Federal Reserve, June 2023), some institutions "disperse accountability for their third-party risk management processes among their business lines" while others "centralize the processes under their compliance, information security, procurement, or risk management functions." Either structure is acceptable, provided every stage of the lifecycle has an owner.
This list names the eight roles a mature program needs, in rough order from the top of the house down to the inventory. Each entry says which line of the Three Lines Model the role sits on, what it owns outright, and what it hands to the next role. Titles vary by company. Ownership should not.
A RACI across the lifecycle stages closes the post, so you can check your own program for the stage nobody holds.
The Short Answer
In a mature program the chief risk officer owns risk appetite and oversight, the chief compliance officer owns the regulatory map and the policy, the chief procurement officer owns sourcing and the contract gates, the CISO owns the security standard and cyber monitoring, the third-party risk manager runs the program day to day, analysts own assessments and due diligence, business relationship owners carry first-line risk and vendor performance, and the vendor management office keeps the inventory, contracts and renewals current.
How the three lines of defense shape TPRM ownership
Who manages, who challenges, who assures
Most practitioners still say three lines of defense. In 2020 the Institute of Internal Auditors retired that name when it published the IIA Three Lines Model as "an update of the Three Lines of Defense," and the rename was deliberate. Organizations are asked to focus on "the contribution risk management makes to achieving objectives and creating value, as well as to matters of 'defense' and protecting value," with a warning that the lines "are not intended to denote structural elements but a useful differentiation in roles." Numbering does not mean sequence either: "all roles operate concurrently."
Three roles, simply put. First line roles are "most directly aligned with the delivery of products and/or services to clients of the organization," and "responsibility for managing risk remains a part of first line roles and within the scope of management." Second line roles "assist with managing risk" by providing "complementary expertise, support, monitoring, and challenge." Internal audit is the third line, giving "independent and objective assurance and advice on the adequacy and effectiveness of governance and risk management." Above all three sits the governing body, which "determines organizational appetite for risk and exercises oversight of risk management."
Applied to third parties, that gives you a clean test for written third party risk management roles and responsibilities. Whoever uses the vendor owns its risk (first line). Risk, compliance and security set the standard, run the assessment and challenge the business (second line). Internal audit checks that the first two are working (third line) and is deliberately absent from the list below, because it must not run the program it assures. Read from the other direction, the Interagency Guidance draws the same picture: the board "has ultimate responsibility for providing oversight for third-party risk management and holding management accountable," management "is responsible for developing and implementing third-party risk management policies, procedures, and practices," and, in a footnote most readers skip, "each applicable business line can provide valuable input into the third-party risk management process, for example, by completing risk assessments, reviewing due diligence information, and evaluating the controls over the third-party relationship."
- Board and the chief risk officer: appetite, oversight, escalation.
- Second line: chief compliance officer, CISO, third-party risk manager, third-party risk analysts.
- First line: chief procurement officer, business relationship owners, the vendor management office.
- Third line: internal audit, which reviews all of the above and reports to the board.
Chief risk officer: risk appetite & program oversight
Sets the appetite, owns the oversight
A chief risk officer owns the question the board will ask after a vendor failure: was this inside our appetite? Under the Interagency Guidance the board provides "clear guidance regarding acceptable risk appetite," approves policies and ensures "appropriate procedures and practices have been established." Someone has to turn that guidance into something a program can run against: a tolerance per risk domain, a definition of which activities count as critical, and the threshold at which a single vendor issue reaches the board. That person is the CRO. Per the Three Lines Model, "organizations may wish, and their regulators may require," second line leaders such as a chief risk officer "to have a direct reporting line to the governing body." Use it.
Three artifacts prove the CRO is doing the job. A risk appetite statement that names third-party tolerances in measurable terms, not adjectives. A tiering methodology that says what makes a vendor Tier 1 and who can override it. And the periodic board pack the guidance expects, covering "the results of management's planning, due diligence, contract negotiation, and ongoing monitoring activities." Commissioning the independent reviews the guidance calls for, and making sure their findings land somewhere with a due date, completes the list.
One failure comes up more than any other: a CRO who runs the program as well as overseeing it. Challenge disappears the moment one person owns the queue and judges the queue. Keep execution with the third-party risk manager and keep the CRO one level up.
Chief compliance officer: regulatory alignment & policy
Turns regulation into policy
A chief compliance officer owns the map from each regulation to the control that satisfies it. For a US bank that map starts with the Interagency Guidance and may run through NYDFS Part 500, OFAC screening obligations, the FCPA and, for importers, the UFLPA. EU-facing entities add DORA. Which obligations the third-party program carries, which belong elsewhere, and how each one is evidenced: those are the CCO's decisions, and together they become the TPRM policy. Written well, that policy reads like a set of thresholds and owners rather than a restatement of the guidance.
A second job is spelled out in the guidance itself. Management should be "assessing whether the banking organization's compliance management system is appropriate to the nature, size, complexity, and scope of its third-party relationships." In practice the CCO sets the screening standard (which lists, which ownership threshold, who may clear a hit and on what documented basis), the anti-bribery due diligence standard for intermediaries, and the attestation cadence for forced labor and ESG obligations. Like the CRO, this officer should hold the direct reporting line to the board the Three Lines Model describes.
- An obligation register that maps each regulation to a control, an owner and an evidence source.
- A TPRM policy approved by the board, with a review date and a change log.
- A screening standard that states who adjudicates a sanctions or adverse media hit and what rationale must be recorded.
- A policy exception process, so a business decision to deviate is documented rather than silent.
Chief procurement officer: sourcing & contract gates
Holds the front door
If a vendor can be engaged without passing through procurement, the rest of this list is working from an incomplete inventory. A chief procurement officer owns the front door: every request enters through one intake, gets a risk tier before anyone negotiates price, and cannot reach a purchase order until the gates clear. Among management's core activities, the Interagency Guidance lists "providing that contracts with third parties are appropriately reviewed, approved, and executed," and procurement is where that review is enforced.
Gates are the point. No contract signature until the tier is set and the diligence for that tier is complete. No contract without the clauses the second line requires: audit rights, notification of subcontracting and security incidents, service levels, termination and data return. No payment set-up until banking and tax details are validated. Procurement does not have to perform the assessments behind those gates. It has to refuse to open them until they are done, which is where procurement & compliance collaboration either works or collapses into email.
Cycle time with the gates intact is the CPO's own metric. A program that onboards in days by skipping diligence has moved the risk, not removed it. One that takes months because reviews run one after another has handed the business a reason to go around procurement. Run the reviews in parallel and measure both numbers.
CISO: security assessments & cyber monitoring
Owns the security standard
For a New York regulated entity this role is not optional. 23 NYCRR Part 500, as amended November 1, 2023, says "each covered entity shall designate a CISO" (section 500.4(a)), requires that officer to "report in writing at least annually to the senior governing body on the covered entity's cybersecurity program" (500.4(b)), and in section 500.11 requires written third-party service provider policies covering "minimum cybersecurity practices required to be met by such third-party service providers" and "periodic assessment of such third-party service providers based on the risk they present." Outside New York, that is still a fair description of what a ciso owns in a third-party program.
Setting the standard is the job, and the standard has four parts. Which assessment each tier gets (a SIG Lite, a full SIG, a SOC 2 Type II review, a penetration test summary) and what counts as acceptable evidence. An external ratings floor, plus the drop that triggers a look between reviews. An incident notification window written into contracts and the playbook that runs when a vendor uses it. And a fourth-party view: which critical vendors share a cloud sub-processor, because that concentration is the CISO's to surface. Certa's post on cybersecurity in TPRM covers the assessment side in more depth.
What the CISO should not own is the business decision to accept residual security risk. That belongs to the business relationship owner, with the CISO's challenge recorded next to it. A CISO who signs every risk acceptance has quietly become the first line for a thousand relationships.
Third-party risk manager: day-to-day program ownership
Runs the program every day
A third party risk manager is the one role on this list that exists only for this program. Appetite belongs to the CRO and policy to the CCO. Everything that turns those two documents into a Tuesday belongs to the manager: procedures, the assessment calendar by tier, the questionnaire library, the workflow and the tool it runs in, the findings register, the KRI dashboard, and the first draft of every board pack and exam response. In some companies the title is vendor risk manager, TPRM lead or head of third-party risk. Scope is the same.
Two things separate a good manager from a busy one. First, the exception register. Every risk acceptance, every assessment waived, every overdue finding tolerated gets written down with who decided and why. Silence is what examiners write up. Second, the cadence.
- Weekly: the queue by tier, overdue items, open alerts, anything escalated to the CRO.
- Monthly: KRIs against thresholds, findings aging, inventory reconciliation with accounts payable and single sign-on logs.
- Quarterly: board pack, policy exceptions, a sample of closed assessments re-read for quality.
- Annually: policy and procedure review, tiering recalibration, the independent review the guidance expects.
Management's hardest line in the guidance also lands here: "terminating business arrangements with third parties when they do not meet expectations or no longer align with the banking organization's strategic goals, objectives, or risk appetite." No manager makes that call alone, but the manager is the one who puts it on the table.
Third-party risk analyst: assessments & due diligence
Does the assessment work
A third party risk analyst owns the file the examiner reads. For each assessment that means the inherent risk questionnaire answered with the business owner, the scope set by tier, the evidence requested and chased (SOC 2 Type II, penetration test summary, certificate of insurance, financial statements, sub-processor list), the sanctions, PEP and adverse media screens with their dispositions, and the findings written with a severity, an owner and a due date. Analysts do not accept the risk. They make the risk legible to the person who will.
Collection work is where the job drowns, and it is the part worth automating first. Certa's Pre-Fill Agent pulls third-party data from websites, news and documents and pre-populates forms and DDQs, so the analyst starts from a draft rather than an empty questionnaire. One global life sciences leader with 50,000+ third parties reports "1,000+ monthly third-party requests automated" on Certa through DDQ pre-fill across 20 risk domains. Whatever tool you use, keep the analyst's judgment on the findings and keep the rationale for each disposition in the record. Assistants draft. Analysts decide.
Business relationship owner: vendor performance & first-line risk
Carries the first-line risk
Every third party needs a named person in the business who wanted it, uses it and answers for it. Call the role business relationship owner, business sponsor or vendor manager, but make it a name, not a department. Per the Three Lines Model, "responsibility for managing risk remains a part of first line roles," and the Interagency Guidance's footnote on business lines lists the owner's contribution: "completing risk assessments, reviewing due diligence information, and evaluating the controls over the third-party relationship."
Concretely, the owner answers the inherent risk questionnaire truthfully, signs any residual risk acceptance, reads the vendor's performance against the SLAs in the contract, raises service failures with the vendor and reports them to the program, and drives remediation of findings on the vendor side through the relationship, because a vendor returns its sponsor's calls faster than it returns the risk team's. Owners also tell the program when the relationship changes, and that last duty is the one most programs never write down.
- Scope creep: the vendor now does more, or handles more data, than the assessment covered.
- A new subcontractor or sub-processor behind the service.
- A change of control, key personnel or financial condition at the vendor.
- An incident the vendor mentioned informally before it sent formal notice.
- A plan to stop using the vendor, so offboarding starts before the last invoice.
Vendor management office: inventory, contracts & renewals
Keeps the record of truth
A vendor management office owns the single list every other role depends on. Among the documentation examiners expect, the Interagency Guidance names it first: "a current inventory of all third-party relationships (and, as appropriate to the risk presented, related subcontractors) that clearly identifies those relationships associated with higher-risk activities, including critical activities." Current is the operative word. An inventory reconciled once a year is a historical document.
Beyond the list, the VMO owns the contract metadata that drives everything downstream: term, notice period, auto-renewal date, the clauses present and absent, the documents on file and their expiry dates. It runs the renewal calendar so a reassessment lands before the renewal rather than after it, and it runs offboarding, which the guidance frames around "data retention and destruction, information system connections and access control" after the relationship ends. Certa's note on vendor management office essentials walks through the function in more detail.
- Reconcile the inventory monthly against the vendor master, card spend and single sign-on logs.
- Flag every auto-renewal 120 days out, with the tier and the date of the last assessment attached.
- Track document expiry (COI, SOC 2, ISO 27001, licenses) and block renewal on a lapsed critical document.
- Close every exit with a checklist: access removed, data returned or destroyed, obligations settled, inventory updated.
Giving every role its own workspace in Certa
One workflow, every role inside it
Eight roles means eight places for a handoff to fail, and most of them fail in email. One practical fix is to put every role on the same workflow so a handoff is a status change rather than a message. That is how Certa is used. In Certa's words, "in most organizations, multiple departments use Certa together to collaborate on shared workflows and maintain a complete view of third party risk and compliance." Procurement runs intake, analysts work the queue, business owners answer the questions only the business can answer, and approval is routed "to the right approvers with a complete audit trail."
Two details matter for the ownership model in this post. On the Certa TPRM suite, "every screen, adjudication, and disposition" is captured with "documented rationale, citations, and timestamps," so the exception register the risk manager owns builds itself. And Vibe Configuration™ lets the second line change its own program: in Certa's description it will "turn a policy into a live workflow, no code, no IT ticket," which is how a compliance team owns its programs without waiting on engineering. Certa Concierge, the in-platform assistant, answers each user's questions while "always staying within their permissions." One web-infrastructure leader consolidated 8 to 10 teams onto that single platform.
Here is the RACI to test your program against. A = accountable, R = responsible, C = consulted, I = informed. Fill in names, not departments, and look for the row where A is blank.
| Lifecycle stage | Accountable | Responsible | Consulted | Informed |
|---|---|---|---|---|
| Intake and tiering | CPO | Procurement, business owner | Risk manager | VMO |
| Screening | CCO | Analyst | Legal | Business owner |
| Due diligence | Risk manager | Analyst | CISO, CCO, business owner | CPO |
| Remediation | Business owner | Business owner, vendor | Analyst, CISO | Risk manager |
| Approval and risk acceptance | Business owner | Risk manager | CISO, CCO | CRO |
| Contract execution | CPO | Procurement, legal | CISO, CCO | VMO |
| Continuous monitoring | Risk manager | Analyst | CISO | Business owner |
| Performance management | Business owner | Business owner | VMO | Risk manager |
| Periodic reassessment | Risk manager | Analyst | Business owner, CISO | CRO |
| Renewal and offboarding | VMO | VMO, business owner | CISO, legal | Risk manager |
| Appetite, policy and board reporting | CRO | CRO, CCO | Risk manager | Board |
Certa was named a Leader in the 2026 Gartner® Magic Quadrant™ for Third-Party Risk Management Tools for Assurance Leaders. For the roles above, the relevant point is simpler: when all eight work in one system, "who owns this vendor" has an answer on the record.
Sources
- The Institute of Internal Auditors, The IIA's Three Lines Model: An update of the Three Lines of Defense (2020, updated September 2024), position paper page
- The Institute of Internal Auditors, The IIA's Three Lines Model (PDF)
- OCC, FDIC and Federal Reserve, Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920 (June 9, 2023), Governance section at 37935 to 37936
- NYDFS, 23 NYCRR Part 500 as amended November 1, 2023, sections 500.4 and 500.11
TPRM roles & responsibilities questions
Short answers to the questions that come up when a program writes its roles down for the first time.
Who Owns Third-Party Risk in a Large Enterprise?
Oversight belongs to the board, the program belongs to management, and each business owner owns the risk of the vendors they use. Under the Interagency Guidance the board carries "ultimate responsibility for providing oversight for third-party risk management" and management is "responsible for developing and implementing" the policies and practices. Day to day, a second line third-party risk manager runs the program under the chief risk officer, with the chief compliance officer owning policy and the CISO owning the security standard. If you cannot put one name on each of those sentences, ownership is not yet real.
What Does a Vendor Risk Analyst Do Day to Day?
A vendor risk analyst scopes assessments by tier, collects and reads evidence, runs sanctions and adverse media screening, writes findings with a severity and a due date, and keeps each assessment file complete enough for an examiner to follow. On a typical day that is a mix of chasing documents, reviewing a SOC 2 or SIG response, clearing or escalating screening hits with a documented rationale, and updating the findings register. Analysts recommend and document. Business owners accept or remediate.
Should the CISO or Procurement Own Vendor Risk?
Neither should own it alone, because each is a first line for part of the problem. Procurement makes the buying decision, so it cannot be the independent challenge to it. Security is one of seven risk domains, so a CISO owning the whole program leaves six without a natural home. Programs centralized under compliance, information security, procurement or risk are all acceptable under the Interagency Guidance, but the Three Lines Model's test is whether second line roles provide "monitoring, and challenge" to the first line. A workable split: procurement owns the gates, the CISO owns the security standard, and a risk function owns the program and the challenge.
How Many People Does a TPRM Team Need?
Enough to work the critical tier on its calendar, which is a calculation rather than a benchmark. Count the Tier 1 and Tier 2 assessments due in a year, multiply by the hours a full review of each tier takes in your program, add continuous monitoring alerts and findings follow-up, and divide by the productive hours of one analyst. Management is asked by the Interagency Guidance to establish "appropriate organizational structures and staffing (level and expertise)," and independent reviewers check whether "appropriate staffing and expertise are engaged." Automating evidence collection and first-pass screening changes the hours per assessment, which is where most programs find the headcount they were missing.
TPRM Articles
Keep reading
TPRM
Streamlining Due Diligence: Automating Third Party Risk Management
Certa · September 1, 2025
TPRM
Cybersecurity in Third Party Risk Management: Protecting Your Digital Assets
Certa · August 31, 2025
TPRM
Third-Party Risk Management Response: Preparing Your Business for Vendor Breaches
Certa · August 28, 2025
