Why board challenge on third party risk has to make a difference
October 28, 2026
Most firms know which controls third party risk needs. When the FCA reviewed some firms' resilience self-assessments, several weaknesses were about people: who challenged, who owned the issue, and what action was taken.
Ask a UK financial firm how it manages its suppliers and you'll often hear a good answer. There is a register. There are due diligence questionnaires, contract terms, service reviews, exit plans and incident procedures. The framework is well understood.
What a framework can't do is act on its own. Someone has to read a supplier report and doubt it. Someone has to ask the awkward question at the board. Someone has to own the issue, and make sure it is fixed. Those are behaviours, and we think that is where third party risk is won or lost.
Liz Oakes, of the Bank of England's Financial Policy Committee, made a similar point in a May 2026 speech. Her subject was operational and cyber risk frameworks. Just as important as building them, she said, "is facilitating a culture where staff are empowered to put these frameworks into practice".
From 18 March 2027, firms covered by new FCA and PRA rules must keep a register of their material third party arrangements. They must submit it each year and the FCA expects it to be accurate as at 31 December of the year before.
Firms must also notify the regulator of new material arrangements, and of significant changes to existing ones. The FCA expects to hear "at an early stage", before any internal or external commitments are made. That really matters, as the hard questions about a supplier have to be asked before the deal is done, not after.
The rules reach further than “outsourcing”. They cover material arrangements such as the engagement of a third party to build an IT platform, the purchase of third party data services and the use of third party models (including AI).
Notification is not permission. The FCA says the process "is not, however, an approval mechanism", so the judgement about each supplier stays with the firm.
A register is a list. It tells a regulator, and a board, what the firm depends on. It doesn't show whether anyone has questioned what the list says or acted on what it reveals.
Not every weakness in a register is about culture. Some come from poor data or weak contract terms. But whether anyone notices them, and acts, is driven by the culture.
In March 2026, the FCA published what it had learned from some firms' operational resilience self-assessments, a year after the rules' final deadline. Overall, it saw "strong engagement and good progress". Boards must review and approve these documents. Their mapping should include any third parties that could threaten a firm's ability to stay within its impact tolerances.
But the weaknesses it listed included "unclear board engagement, approval processes, and document review trails". It saw "little or no evidence of input from second or third line of defence". It also saw "unclear responsibility for monitoring remediation or other action plans", and some firms without recorded "owners, or target completion dates".
These findings covered self-assessments in general, not suppliers alone. We think supplier risk is where they bite hardest.
The FCA saw good practice too, including governance committees and boards that "provide effective challenge".
Be careful about what this shows. The FCA was reading documents. Where board engagement and review trails were unclear, that is not proof that nobody challenged. But we know from experience that to a supervisor a challenge with no record looks much the same as no challenge at all.
Boards rarely set out to avoid challenge. More often, the paper in front of them makes it hard. Take a supplier summary that reads "green, contract in place, annual review complete". There is nothing there to push against.
Summarising is a decision. Someone chooses what the board sees, and what it doesn't. If the detail stops at "the supplier holds a current certificate", nobody asks what the certificate covers. Nor do they ask when anyone last tested the assumption behind it.
The FCA's own expectation is a useful test. Mapping information, it says, "should be clear and detailed enough for board members to understand and challenge the firm's approach". If a paper can't be challenged, it is a briefing, not governance.
One habit helps. Ask the author of each supplier paper to name the single assumption that, if it proved wrong, would change the board's view. Then ask how it was tested.
The same applies to the second and third lines. If risk management and internal audit are absent from the self-assessment, the board is hearing one voice. In third party risk, that voice may well belong to the people who chose the supplier.
A finding without a named owner and a date is a note, not an action. Third party actions are especially prone to this. The fix may sit with the supplier, the evidence with the relationship manager, and the risk is assumed to sit with the second line. Each can reasonably believe someone else is chasing it.
The FCA's picture of good practice is plain. "Remediation activities are tracked and closed," it says, and clear frameworks and ownership "reduce the risk of delays or incomplete remediation".
So for the suppliers your business depends on most, ask to see four things at the board. None of them needs a new framework.
The last of these is the trace. The register will show what your firm depends on. The board's record should show who questioned it, what changed and how the risk was mitigated.
Dr Jon Baker is a Principal Consultant at Contexis. This is one of four Contexis articles on culture in third party risk. Our Risk Culture Index looks at how risk is understood, owned and acted on, and is built on the Pan-Industry Risk Culture model. Find out more about our risk and control work here.
Ask a UK financial firm how it manages its suppliers and you'll often hear a good answer. There is a register. There are due diligence questionnaires, contract terms, service reviews, exit plans and incident procedures. The framework is well understood.
What a framework can't do is act on its own. Someone has to read a supplier report and doubt it. Someone has to ask the awkward question at the board. Someone has to own the issue, and make sure it is fixed. Those are behaviours, and we think that is where third party risk is won or lost.
Liz Oakes, of the Bank of England's Financial Policy Committee, made a similar point in a May 2026 speech. Her subject was operational and cyber risk frameworks. Just as important as building them, she said, "is facilitating a culture where staff are empowered to put these frameworks into practice".
The new register will show dependence, not challenge
From 18 March 2027, firms covered by new FCA and PRA rules must keep a register of their material third party arrangements. They must submit it each year and the FCA expects it to be accurate as at 31 December of the year before.
Firms must also notify the regulator of new material arrangements, and of significant changes to existing ones. The FCA expects to hear "at an early stage", before any internal or external commitments are made. That really matters, as the hard questions about a supplier have to be asked before the deal is done, not after.
The rules reach further than “outsourcing”. They cover material arrangements such as the engagement of a third party to build an IT platform, the purchase of third party data services and the use of third party models (including AI).
Notification is not permission. The FCA says the process "is not, however, an approval mechanism", so the judgement about each supplier stays with the firm.
A register is a list. It tells a regulator, and a board, what the firm depends on. It doesn't show whether anyone has questioned what the list says or acted on what it reveals.
Not every weakness in a register is about culture. Some come from poor data or weak contract terms. But whether anyone notices them, and acts, is driven by the culture.
The FCA found challenge hard to see
In March 2026, the FCA published what it had learned from some firms' operational resilience self-assessments, a year after the rules' final deadline. Overall, it saw "strong engagement and good progress". Boards must review and approve these documents. Their mapping should include any third parties that could threaten a firm's ability to stay within its impact tolerances.
But the weaknesses it listed included "unclear board engagement, approval processes, and document review trails". It saw "little or no evidence of input from second or third line of defence". It also saw "unclear responsibility for monitoring remediation or other action plans", and some firms without recorded "owners, or target completion dates".
These findings covered self-assessments in general, not suppliers alone. We think supplier risk is where they bite hardest.
The FCA saw good practice too, including governance committees and boards that "provide effective challenge".
Be careful about what this shows. The FCA was reading documents. Where board engagement and review trails were unclear, that is not proof that nobody challenged. But we know from experience that to a supervisor a challenge with no record looks much the same as no challenge at all.
A board paper can design challenge out
Boards rarely set out to avoid challenge. More often, the paper in front of them makes it hard. Take a supplier summary that reads "green, contract in place, annual review complete". There is nothing there to push against.
Summarising is a decision. Someone chooses what the board sees, and what it doesn't. If the detail stops at "the supplier holds a current certificate", nobody asks what the certificate covers. Nor do they ask when anyone last tested the assumption behind it.
The FCA's own expectation is a useful test. Mapping information, it says, "should be clear and detailed enough for board members to understand and challenge the firm's approach". If a paper can't be challenged, it is a briefing, not governance.
One habit helps. Ask the author of each supplier paper to name the single assumption that, if it proved wrong, would change the board's view. Then ask how it was tested.
The same applies to the second and third lines. If risk management and internal audit are absent from the self-assessment, the board is hearing one voice. In third party risk, that voice may well belong to the people who chose the supplier.
Ownership is where good intentions go missing
A finding without a named owner and a date is a note, not an action. Third party actions are especially prone to this. The fix may sit with the supplier, the evidence with the relationship manager, and the risk is assumed to sit with the second line. Each can reasonably believe someone else is chasing it.
The FCA's picture of good practice is plain. "Remediation activities are tracked and closed," it says, and clear frameworks and ownership "reduce the risk of delays or incomplete remediation".
So for the suppliers your business depends on most, ask to see four things at the board. None of them needs a new framework.
- The dependency: which key services rely on this supplier, and what happens to customers if it stops?
- The assumption: what does your comfort rest on? A certificate, a tested exit plan, a second supplier? When was it last checked?
- The open actions: what is outstanding, who owns each item, and when will it close?
- The challenge: what did the board ask last time, what was it told, and what changed as a result?
The last of these is the trace. The register will show what your firm depends on. The board's record should show who questioned it, what changed and how the risk was mitigated.
Dr Jon Baker is a Principal Consultant at Contexis. This is one of four Contexis articles on culture in third party risk. Our Risk Culture Index looks at how risk is understood, owned and acted on, and is built on the Pan-Industry Risk Culture model. Find out more about our risk and control work here.
Related articles
Read
Humanising business – the new organisational imperative
22.05.2023
The role of business in society has changed. But what does humanising business actually mean?
Read article
Read
How can you manage corporate risk through culture?
10.09.2024
Managing corporate risk is usually about processes and oversight to predict and avoid human error. But we all know it’s people that cause problems, and who will save you from them if they care enough. As Warren Buffett says “culture, more than rule books determine...
Read article
Read
Face the future with a lot more humility
05.12.2023
Purpose leads to higher engagement and profitability. But you cannot show whether your purpose is working if you cannot measure it and ESG does not measure purpose. We want to prove it's happening and the Contexis Index gives us a measure of where we go next.
Read article