Who Is Considered a Third Party or Vendor?

When it comes to third-party risk management (TPRM), there is often confusion regarding the terms used to describe the types of relationships that need to be managed. "Third party" and "vendor" are the most common terms used to describe the business entities or individuals that provide products or services directly to an organization or its customers on the organization's behalf.

These days, the terms vendor and third party are often used interchangeably. Most organizations make no meaningful or substantial differentiation between the two terms and that's okay.  How you refer to these relationships is not as important as understanding that third parties/vendors can expose your organization and customers to risk. The identification and management of those risks is the heart of an effective third-party risk management practice.

Examples of Third Parties/Vendors

Here are a few examples of entities that are considered third parties or vendors:

• Software as a Service (SaaS) providers
• Outsourced data centers
• Consultants
• Office Suppliers
• Janitorial services
• Marketing and advertising
• Computer hardware
• Software reseller (SaaS)
• Data centers

It’s also essential to understand that your organization's TPRM or vendor risk management (VRM) team is responsible for managing and mitigating the risk of those relationships. So, it’s important to closely inspect and monitor those business relationships that pose risks to your organization. You can think of this general idea as "knowing your vendor."

How to Know Your Third Party/Vendor

Knowing your vendor isn't just a concept; it’s an important business practice. How do you "know your vendor”? What exactly does this mean? In essence, it means that your organization should assess the vendor's operations and competence in providing prospective services and meeting their contractual obligations. This is especially true if the relationship falls under any regulatory supervision. This process is essential and helps you verify that your vendors don't pose any unnecessary risks to the organization or its customers.

It doesn't matter if your organization uses the term third party or vendor to describe the business entities that provide products and services. What is important is understanding and utilizing effective third-party or vendor risk management practices to minimize the risk in those relationships.