Faced with the constant challenge of meeting expectations for strong financial performance and increased technological innovation, companies across many industries have been increasing their reliance on third-party service providers. While the extent to which companies rely on these third parties may vary, such services could involve the provision of information technology operations (i.e., hosting and change management, software development, etc.) property management services, and other professional services (e.g., cloud-based accounting services, human resources, audit services, etc.).

This trend is not new, and in order to manage the risk that comes along with reliance on third parties, many companies have established third-party risk management frameworks. However, as more and more companies increase their reliance on them, and with the growing level of interconnectedness across industries, are there potential concentration risks looming that may not be visible to companies through their own risk management frameworks? Consider past failures of financial institutions that have been due to the lack of proper identification and management of concentration risk in both their revenue sources and in their assets. Could industry-wide concentration in third parties be the next cause of economic failures?

Investors, too, should consider third-party risk within their due diligence and research activities. But what can they do to better understand whether the companies they’re invested in, or are considering investing in, are vulnerable to such risk?

Investors should consider the following three questions:

1. What is included in the company’s disclosure about third-party risk?

It’s common for most companies to disclose information about key risks they face and provide an overview of controls in place to mitigate these risks. If a company considers third-party risk crucial, it should provide commensurate levels of disclosure about both its risk exposure and its third-party risk management program. The disclosure may also provide insights into which third parties are considered the most critical to the ongoing viability of the firm’s operations.

2. How does the company evaluate the effectiveness of its third-party risk management practices?

The trend of increased reliance on third parties is not new, and many companies have established frameworks and controls for managing the risk of these practices. Companies should monitor all critical arrangements to ensure that the service is delivered in the manner expected and is consistent with their own standards. This monitoring may include providing initial and ongoing due diligence activities, establishing prudent contractual provisions, engaging in active monitoring of the service provider, and ensuring the service provider has an acceptable business continuity plan.

Firms looking to assess the effectiveness of these practices in relation to sound industry standards may wish to consider those established by financial regulators. In the United States, both the Federal Reserve and the Office of the Comptroller of the Currency have recently updated their own guidance for the institutions they regulate. In Canada, the Office of the Superintendent of Financial Institutions, Canada’s regulator and supervisor of federally regulated financial institutions, maintains guidance for managing outsourcing arrangements.

3. How can an investor identify and assess industry-wide concentration in a third party?

Consider a situation in which a third party is providing a critical service to many firms within the same industry. What would be the potential impact if the third party encountered a significant issue and ceased operations? How can this concentration risk be identified and managed, and where does responsibility for this assessment rest—with the company or the third party? While companies can attempt to inquire about potential concentration risk from these third parties, there may be little incentive for them to release this information.

There is a growing need for companies to work together to identify and manage such concentration risks. Organizations such as CORE (Centre for Outsourcing Research and Education) are working to help firms manage risks and optimize the value of outsourcing relationships and increase knowledge and experience by providing educational services, and they can also play an important role in such industry-wide activities.

While third-party service providers can offer financial and strategic value to companies, they can also present new risks. Companies in all industries, both large and small, should be aware of these risks and take appropriate actions to protect their internal operations, customers, investors, and other relevant stakeholders. Similarly, investors should consider third-party risk as a key investment risk and consider these questions as part of their due diligence and research activities.