Executive summary
Wealth programs depend on custody, core, portfolio accounting, market data, planning, CRM, onboarding, document, communication, analytics, cloud, cybersecurity, and specialist providers. The bank remains accountable for the regulated service even when a provider performs material work.
Practical third-party risk management begins with the proposed use, affected clients and products, data, transactions, decisions, integration, control reliance, business continuity, subcontractors, financial and strategic dependency, and credible alternatives. The depth of diligence follows that risk context.
Define the service and accountability boundary
Document what the provider will do, what the bank retains, affected processes and controls, decision rights, data flows, users, interfaces, subcontractors, service levels, evidence, and transition dependencies.
Test capability in context
Evaluate architecture, security, privacy, compliance support, model and AI use, data governance, availability, recovery, operations, staffing, financial condition, implementation capacity, roadmap, incidents, and relevant assurance.
Contract for operation and change
Address performance, data rights, access, audit and evidence, incident notification, vulnerabilities, subcontractors, change notice, model and AI transparency, recovery, cooperation, termination, transition, and data return or destruction.
Monitor what can change risk
Track service, incidents, control findings, financial and strategic condition, concentration, subcontractors, product changes, data use, model changes, complaints, issues, remediation, recovery tests, and exit readiness.
Decision-ready diligence record
- Business purpose, materiality, risk assessment, and accountable sponsor
- Architecture, data, integration, control, and operating assessment
- Independent assurance, limitations, open findings, and remediation
- Contract protections, service measures, and evidence rights
- Implementation, monitoring, contingency, and exit plan
From guidance to operating capability
A questionnaire is an input, not a decision. The institution should record unresolved risk, compensating controls, acceptance authority, monitoring, implementation dependencies, and the conditions that would trigger escalation or exit.
Cicrim helps wealth programs connect vendor diligence, architecture, contracts, controls, monitoring, issues, resilience, concentration, performance, and exit planning.
