How to Monitor Third Parties
Monitoring third parties is the ongoing phase of third-party risk management — after onboarding, throughout the relationship. Effective monitoring ensures that vendors maintain the risk posture they demonstrated during due diligence and that emerging risks are identified before they escalate.
Step 1: Establish Monitoring Metrics
Define what you'll monitor for each vendor: performance metrics (SLA compliance, uptime, response times), risk metrics (security incidents, control failures, financial distress signals), compliance metrics (certification status, regulatory actions), and relationship metrics (escalations, complaints). Metrics should be tailored to the vendor's risk tier and services.
Step 2: Set Up Continuous Monitoring
Some metrics can be monitored continuously through automated data collection: security ratings, financial health indicators, certification databases, and news/sanctions screening. Set up automated data feeds where possible, and define thresholds that trigger alerts when metrics exceed acceptable levels. MPG provides risk signal monitoring with threshold-based alerts.
Step 3: Schedule Periodic Reassessments
In addition to continuous monitoring, schedule periodic reassessments at risk-based intervals: high-risk vendors annually (or more frequently), medium-risk vendors every 1-2 years, and low-risk vendors every 2-3 years. Reassessments should repeat the due diligence process to verify the vendor's risk posture hasn't deteriorated. MPG automates risk-based review cycles.
Step 4: Monitor Fourth Parties
Your vendors' subcontractors (fourth parties) can introduce risk to your organization. Monitor fourth-party relationships: understand who your vendors' critical subcontractors are, assess their risk, and track changes. MPG tracks fourth-party relationships and their risk implications.
Step 5: Conduct Event-Triggered Reviews
Certain events should trigger immediate reassessment regardless of the scheduled review date: vendor security incident, vendor ownership change, vendor financial distress, regulatory action against the vendor, material service change, or significant market event. Define trigger events and establish a process for rapid reassessment.
Step 6: Track and Act on Findings
Monitoring generates findings — performance issues, risk signal alerts, assessment failures. Each finding should be tracked with an owner, remediation plan, and due date. MPG links findings to your risk register and tracks remediation through to completion with full audit trails.
Key Takeaways
- Monitoring metrics should be tailored to vendor risk tier and services
- Combine continuous monitoring (automated) with periodic reassessments (detailed)
- Monitor fourth parties — your vendors' subcontractors can introduce risk
- Event-triggered reviews catch issues that scheduled reviews would miss
- Every finding needs an owner and a remediation plan
Frequently Asked Questions
What's the difference between monitoring and surveillance?
Monitoring is the ongoing collection and review of metrics and signals; surveillance is a more targeted, often automated, screening for specific events (e.g., sanctions screening, negative news screening). Both are part of effective third-party monitoring. MPG supports both approaches.
How do we monitor vendors that resist providing information?
Contractual rights to audit and information access should be established during onboarding. For resistant vendors, use external data sources (security ratings, financial databases, public records) and escalate through the contract relationship manager. MPG's assessment workflows include escalation paths for non-responsive vendors.