ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) 3.1: Govern third-party risk within the risk framework: accountability, a management framework and forum, intra-group oversight, KPIs, a register, concentration risk, materiality and outsourcing exit

What does 3.1 require?

The institution remains accountable to customers and stakeholders for risk events arising from third parties regardless of contractual liability. Third-party risk management is part of the risk management framework with senior management reporting to the Governing Body; a third-party management framework governs the whole lifecycle, a management forum takes decisions on arrangements and framework changes, and each arrangement has a competent individual or function overseeing it. Reliance on intra-group or related entities is governed by formal agreements that demarcate dedicated from shared resources, give effective oversight and influence, and ensure those entities meet the institution's regulatory obligations. Key performance indicators with thresholds, not only financial, track every arrangement's performance and risk posture; a register of all arrangements is kept current and accessible to the Governing Body and senior management; concentration risk is considered, whether one third party supplies many services, many third parties depend on one fourth party, or many institutions depend on few providers. Procedures assess the materiality of each arrangement (per GEN Rule 3.3.32 guidance, or significant financial loss, disruption, reputational impact or compliance impact), senior management reviews materiality regularly, and material arrangements receive more stringent due diligence and monitoring. For outsourcing, the institution understands the impact of a provider failing to perform or suffering adverse developments and can make alternative arrangements including re-integrating the service.