What is Fourth-Party Risk?
Fourth-party risk is the exposure an organization carries from the subcontractors, suppliers and service providers that its own third parties rely on to deliver a service. There is no direct contract with a fourth party, but its failure, breach or outage can disrupt the service just as a direct vendor's would, so regulators expect it to be identified and managed.
- Fourth-party risk is the exposure from your vendors' own subcontractors and suppliers: no contract, but a failure still stops your service.
- US interagency guidance and DORA Article 30 both expect firms to know which subcontractors support critical services and how vendors oversee them.
- Find fourth parties through questionnaires, SOC 2 subservice sections, contract schedules and sub-processor lists.
- Manage the exposure through contract terms, assessment of the vendor's own TPRM program, concentration tracking and monitoring.
What is Fourth-Party Risk?
Fourth-party risk is the exposure an organization carries from the subcontractors and suppliers that its own third parties rely on to deliver a service, where no direct contract exists but a failure disrupts the service.
The US Interagency Guidance on Third-Party Relationships addresses fourth parties under the heading of reliance on subcontractors. It expects due diligence to evaluate the volume and types of subcontracted activities, how the third party selects and oversees its subcontractors and ensures they implement effective controls, and whether additional risk is presented by a subcontractor's geographic location or by dependency on a single provider for multiple activities. In the EU, DORA Article 30 requires contracts for ICT services supporting critical or important functions to state whether subcontracting is permitted and on what conditions, and its subcontracting standards extend the chain to any provider that effectively underpins the service.
Why it matters
- Your service depends on it. A payments processor's cloud host, a payroll provider's printing subcontractor or a SaaS tool's data center are single points of failure you never contracted with.
- Breaches travel up the chain. Large multi-company incidents have repeatedly started at a shared supplier several layers away from the affected organizations.
- Regulators expect visibility. Interagency guidance, DORA and the UK PRA all ask firms to know which subcontractors support critical services and how their vendors oversee them.
Finding your fourth parties
You cannot audit what you cannot name. The practical starting points are the vendor questionnaire (a subcontractor section is standard in SIG and similar templates), the vendor's SOC 2 report (the subservice organizations section lists the providers it relies on), contract schedules, and the vendor's public documentation on hosting and sub-processors. For critical services, ask for the subcontracting chain explicitly and require notification of changes.
Managing the exposure
- Contract: consent or notification rights for subcontracting of critical services, flow-down of security and resilience obligations, and audit rights that reach material subcontractors.
- Assessment: evaluate the vendor's own third-party risk program, since you are relying on it to manage the fourth party.
- Concentration: record fourth parties in the vendor inventory so that shared dependencies across many vendors become visible.
- Monitoring: track incidents and financial news about key fourth parties, not only direct vendors.
Nth-party risk
The chain does not stop at four. Fifth and further parties exist, and the practical rule is to follow the chain as far as the service's criticality justifies: for a critical or important function, to every provider whose failure would stop the service; for a low-risk service, no further than the direct vendor's attestation.
Related terms
- Third-party risk
- Third-party risk management (TPRM)
- Supply chain risk management
- Vendor due diligence
- Supplier management
- Operational resilience
In SmartSuite
SmartSuite Third-Party Risk Management records subcontractors as linked entities under each vendor, so a fourth party that appears behind several vendors is visible in one view, and contract clauses, notifications and incidents can be tracked against it.
Frequently asked questions
What is the difference between third-party and fourth-party risk?
Third-party risk arises from an organization you contract with directly. Fourth-party risk arises from the organizations your third party depends on, with which you have no contract. You manage third-party risk through your own due diligence and contract; you manage fourth-party risk mainly through your vendor's program and the terms you impose on subcontracting.
How do we find out who our fourth parties are?
Ask, and read. Vendor questionnaires should include a subcontractor section, SOC 2 reports list subservice organizations, and contracts for critical services should require disclosure of material subcontractors and notice of changes. For the most critical services, request the subcontracting chain and confirm the vendor's own oversight of it.
Does DORA cover fourth parties?
Yes. DORA requires contractual arrangements for ICT services supporting critical or important functions to specify whether subcontracting is permitted and under what conditions, and its regulatory technical standards on subcontracting require financial entities to assess and monitor the chain of ICT subcontractors that effectively underpin those services.
Get started with SmartSuite
See how connected GRC, IT and operations work on one platform.