What is third-party vendor management, and how do you run it?

What is third-party vendor management?

Third-party vendor management is the work of keeping a complete list of the outside parties that do work for an organisation, naming an owner for each, overseeing what they do during the relationship and ending it cleanly. It covers suppliers, but also consultants, agents, partners, affiliates and the subcontractors behind them.

Take a company that sells through a network of independent sales agents, pays a payroll provider and uses a cloud system for customer service. The payroll provider is in the vendor master and has a contract. The agents are paid commission through the sales team, not through procurement. The cloud provider stores customer data with a hosting company the buyer has never met. All three are third parties. A vendor list built from purchase orders shows only the first one.

This page is about running that wider population: the inventory, the owners, the oversight and the exit. Rating and controlling the risk each third party brings, with tiers, due diligence and contract clauses, is explained in vendor risk management. Supplier management as a whole, and why vendor management means the same thing, is in supplier management.

Who counts as a third party?

A third party is any outside entity the organisation has a business arrangement with, whether or not there is a contract or a payment. The 2023 US interagency guidance for banks takes this wide view. It says a third-party relationship “may exist despite a lack of a contract or remuneration”, and it lists outsourced services, independent consultants, referral arrangements, merchant payment processing, services from affiliates and subsidiaries, and joint ventures as examples.

Analysts draw the same line between the narrow and the wide view. Gartner’s market definition of supplier risk management solutions says that supplier risk focuses on the direct relationships with suppliers, while third-party risk management “encompasses a more extensive array of external entities”. A procurement team that manages only suppliers with purchase orders manages part of its third parties.

How is it different from vendor management and vendor risk management?

The three terms overlap, but each puts the boundary in a different place. Vendor management usually starts from the suppliers that procurement buys from. Third-party vendor management starts from every outside party, whoever brought it in. Vendor risk management is one activity inside both: the rating and control of risk.

Banks, insurers and other regulated firms tend to use “third-party” because their supervisors do. A manufacturer or a public body may never use the word, but it still has agents, consultants and cloud providers outside its supplier process.

How do you build a third-party inventory?

A third-party inventory is one list of every outside party, with what it does, who owns it and how critical it is. The US interagency guidance asks banks to keep “a current inventory of all third-party relationships (and, as appropriate to the risk presented, related subcontractors)”, and to mark those that support higher-risk and critical activities. The same list works for any organisation.

1. Start from payments. Take the vendor master and twelve months of payments, including card spend and expense claims. Merge duplicates so each party appears once. The supplier master data guide explains how to keep that record unique.
2. Add the contracts. Compare the list with the contract register. A contract with no payment may be a partner or an affiliate; a payment with no contract is a gap to close.
3. Add system access. Ask IT for the outside companies and people with accounts on your systems, and for the software you subscribe to. A consultant with an administrator account belongs in the inventory even if an agency pays them.
4. Ask each business unit. Sales, HR, marketing and operations often run agents, brokers, recruiters or joint ventures that never reach procurement. One short form per unit finds most of them.
5. Record the essentials. For each third party: what it does for you, the data and systems it touches, whether it deals with your customers, its key subcontractors, the contract and end date, and the business owner.
6. Mark the critical ones. Flag the relationships whose failure would stop a critical service, harm customers or hurt the financial position. These get the closest oversight.
7. Keep it current. Add new parties at onboarding, remove them at exit, and compare the list with payments and access at least once a year.

EU financial entities already keep such a list for technology. Article 28 of DORA, the EU Digital Operational Resilience Act, requires a register of information on all contracts for ICT services from third-party providers, separating those that support critical or important functions, applicable since 17 January 2025. Outside finance, the same register works as a model for technology suppliers.

Who does what in third-party vendor management?

Each third party needs one business owner, the person who asked for the relationship and uses its work. Procurement runs the process around that owner. Specialists check what they know best, and management decides on the risks nobody else can accept.

In banking, the top of this chain is written down. The US guidance says the board “has ultimate responsibility for providing oversight for third-party risk management”, and that management develops the policies, reports to the board and ends arrangements that do not meet expectations. It also asks banks to give monitoring enough staff with “the necessary expertise, authority, and accountability”.

What does oversight look like during the relationship?

Oversight during the relationship means checking, on a set rhythm, that the third party still does what was agreed and that nothing important has changed. The depth follows how critical the relationship is. The US guidance says monitoring can be periodic or continuous, with “more comprehensive or frequent monitoring” for critical activities.

The guidance also lists what to look at. In plain terms, the business owner and procurement check:

• Service results against the contract: service levels, deliveries, errors and complaints from your customers.
• Changes at the third party: new owners, a new strategy, key staff leaving, money problems or lapsed insurance.
• Audit and test results: security reports, continuity tests and any findings that come back again.
• Incidents and how the third party handled them: outages, data breaches, new security threats.
• Subcontractors: new ones, and where they do the work.
• Invoices against the contract: prices, volumes and services that were never ordered.
• Whether the relationship still fits what the organisation needs and the risk it is willing to take.

For example, the owner of a payroll provider meets it every quarter and reviews late or wrong payslips, the provider’s latest control report and any change of hosting company. When the same audit finding appears two years running, the owner escalates it to management instead of noting it again. The service review itself, with scorecards and improvement plans, is explained in supplier performance management; the risk triggers that call for a new assessment are in vendor risk management.

How do you manage your vendors’ subcontractors?

You manage a vendor’s subcontractors through the vendor: you ask who they are, you write rules about them into the contract and you follow changes. Many practitioners call them “fourth parties”. The US guidance does not use that word; it speaks of subcontractors, and asks banks to look at the volume and type of work subcontracted and at how the third party oversees its own subcontractors.

• Before signing, ask for the list of subcontractors that will touch your data, your customers or a critical part of the service, and where they work.
• In the contract, require notice before a new subcontractor is used, or your consent for critical work, and make the main vendor answer for its subcontractors.
• During the relationship, ask for the updated list at each review and add the critical subcontractors to your inventory.
• Watch concentration. If several of your vendors rely on the same hosting company or the same payment processor, one failure hits them all. The US guidance asks banks to report dependency on a single provider for multiple activities.

Public buyers in the EU have a similar duty for some contracts. For works contracts, and for services delivered at a facility under the buyer’s direct oversight, Article 71(5) of Directive 2014/24/EU makes the authority ask the main contractor for the names and contact details of its subcontractors, and to be told of changes during the contract.

How do you end a third-party relationship?

End a third-party relationship as a small project with a checklist, not by letting the contract lapse. The US guidance lists what a bank considers at termination: the options to move the service, the time and skills needed to move it or bring it in-house, termination costs, the data and system access after the end, and jointly owned intellectual property.

1. Choose the route. Move the work to another provider, bring it in-house or stop it. Check the notice period and termination costs in the contract.
2. Plan the transition. Agree dates, the help the outgoing third party must give and how long it must keep running the service in parallel.
3. Recover or destroy the data. Get your data back in a format another system can read, then obtain written confirmation that the remaining copies are destroyed, unless a law requires the vendor to keep them.
4. Remove access. Close accounts, revoke keys and certificates, recover badges and equipment. IT confirms the list is empty.
5. Settle intellectual property. Decide who keeps what was built together, such as reports, code or designs, as the contract says.
6. Close the money and the record. Pay the last invoice, recover any credit, release guarantees, then mark the third party inactive in the inventory and the vendor master.

Write this plan at the start for critical relationships. When a critical provider fails without warning, there is no time to find out where your data is. How a supplier record moves to inactive status at the end of its life is explained in supplier lifecycle management.

What do banking and insurance rules ask for?

Banks and insurers face written rules on third parties; most other organisations do not. The rules are still a useful model of what a complete programme looks like. The table sums up three of them.

The UK statement makes a point that applies everywhere: buying hardware or a software licence is not outsourcing, but it still needs a risk check when it is material. The PRA allows one single policy for outsourcing and other third-party arrangements.