By Rimla Khawaja, Head of Third-Party Risk Management Governance, Crédit Agricole CIB; Part-time Lecturer in the M.S. in Enterprise Risk Management (ERM) Program
The risk that actually haunts a third-party risk management (TPRM) program isn't the vendor you signed with — it's the one you never met.
Back in 2004, when I was starting out at Citi Equity Research, third-party risk management wasn't even on a tier-one bank’s radar. It simply wasn't a concept anyone at that level was thinking about yet. Over the two decades since, I've spent most of my career working directly in TPRM at tier-one financial institutions and insurers, and I've watched that shift happen from the inside, moving from an afterthought to a board-level priority. Regulators expect third-party risk management now, examiners test for it, and large institutions have dedicated programs to manage it.
But the risk hasn't stayed still. Increasingly, the ghost under the bed that keeps risk officers up at night isn't the vendor they contracted with directly — it's that vendor's own vendors. Fourth-party risk, and the nth-party chains beneath it, is where regulatory attention is concentrating now, and it's where I've seen the sharpest edge of this problem play out firsthand.
While working in TPRM at a tier-one bank, I watched this risk materialize in real time. The bank had hired a vendor to decommission thousands of hard drives and servers from two closed data centers. That vendor, in turn, relied on its own subcontractors — fourth parties the bank never directly assessed — and the decommissioning process failed to properly wipe customer data before the equipment was resold, exposing customer information. In 2020, the Office of the Comptroller of the Currency (OCC) assessed a $60-million civil money penalty against the bank, citing its failure to adequately assess "the risk of using third-party vendors, including subcontractors." At the time, my TPRM team asked me to lead the initiative to build that missing "termination" control into our program, closing the exact gap the OCC had identified. It was a clear, firsthand example of how exposure two layers removed from your own contract can still land squarely on your institution's books, and trigger consequences regardless of who actually caused the failure. And those consequences aren't just financial — the reputational hit often lands harder than the one on the wallet.
That's the perspective I bring into the classroom: not just a textbook definition of fourth-party risk, but a real, regulator-documented case of what happens when it goes wrong, and what it demands of a risk program that wants to stay ahead of it rather than react to it. As more of our critical infrastructure runs through the same small set of cloud, identity, and security providers, this is no longer an edge case. It's becoming the central question in third-party risk management, and it's one I expect our students to be grappling with, not as an academic exercise, but as the actual shape of the job they're walking into.
So, an early Happy Halloween — and don't be scared of the fourth-party ghost. Just make sure you know it's there.
Views and opinions expressed here are those of the author and do not necessarily reflect the official position of Columbia University School of Professional Studies or Columbia University.
About the Program
The Master of Science in Enterprise Risk Management (ERM) program at Columbia University prepares graduates to inform better risk-reward decisions by providing a complete, robust, and integrated picture of both upside and downside volatility across an entire enterprise. For both the full-time and part-time options, students may take all their courses on Columbia’s New York City campus or choose the synchronous online class experience. Learn more about the program here.
