Your Third-Party Risk Program Has a Staffing Requirement Most Banks Haven't Documented
September 29, 2026
Ric Hall, CRO— AI-assisted and reviewed prior to publication.
A bank's third-party risk policy can be flawless on paper and still fail an exam if the people running it can't show they're qualified to do so. The 2023 Interagency Guidance from the Fed, OCC, and FDIC requires banking organizations to involve staff with the requisite knowledge and skills at every stage of the third-party risk life cycle, and examiners are now asking banks to name those people and prove their competence.
What Does the 2023 Interagency Guidance Actually Require of Your Risk Team?
The guidance is explicit that qualified people, not just documented processes, are a compliance control. The Interagency Guidance on Third-Party Relationships: Risk Management, issued jointly by the Federal Reserve, FDIC, and OCC in June 2023, replaced each agency's separate third-party bulletins with one unified framework covering the full relationship life cycle.
Analysis of the final text notes that the agencies specify banks should "involve staff with the requisite knowledge and skills in each stage of the risk management life cycle", and that this extends beyond the risk function itself. Legal commentary on the release adds that the guidance stresses the importance of involving staff with the requisite knowledge and skills in each stage of the risk management life cycle as well as experts across disciplines, such as compliance, risk, or technology, legal counsel, and external support. That is a personnel requirement written into a supervisory document, not a suggestion buried in a footnote.
This matters because it shifts the compliance question from "do you have a policy" to "who executes it, and are they qualified." A risk committee that rubber-stamps vendor onboarding without staff who understand cloud architecture, contract law, or concentration risk is not meeting the guidance's expectation, regardless of how detailed the written policy is.
Where Do Examiners Actually Look for This on Exam Day?
Examiners check staffing adequacy directly, not just policy language, during compliance reviews. The FDIC's own consumer compliance examination manual instructs examiners to determine if management allocates sufficient qualified staff to monitor significant third-party relationships and provides the necessary oversight. That is a line item in the actual exam procedure, which means an examiner can ask you to produce evidence, not just describe your process verbally.
The companion guide the agencies published for community banks reinforces the same expectation earlier in the life cycle. It directs banks, during planning, to have the bank's human resources staff to assess whether management and staff have the expertise and capacity to manage the relationship. In other words, staffing adequacy isn't just checked at the monitoring stage. It's supposed to be assessed before you even sign the contract.
Community banks in particular are the intended audience here. The Third-Party Risk Management guide for community banks, published jointly by the three agencies in May 2024, walks through planning, due diligence, contract negotiation, ongoing monitoring, and termination as distinct life cycle stages, each with its own staffing implications.
What Skill Set Does Each Life Cycle Stage Actually Demand?
Different stages of the relationship call for different expertise, and treating the whole life cycle as one generic "vendor management" function is where most staffing gaps hide.
| Life Cycle Stage | What the Guidance Expects | Typical Skill Gap |
|---|---|---|
| Planning | Assess whether staff have capacity and expertise before engaging a vendor | No one evaluates technical fit before procurement starts |
| Due Diligence | Evaluate the vendor's controls, financial condition, and subcontractor risk | Risk staff can't interpret a SOC 2 report or cloud architecture diagram |
| Contract Negotiation | Align terms with regulatory requirements and risk appetite | Legal drafts the contract without risk or security input |
| Ongoing Monitoring | Track performance, incidents, and control changes over time | Monitoring becomes a checklist exercise instead of a risk review |
| Termination | Manage data return, access revocation, and transition risk | No one owns technical offboarding until it's already overdue |
The consumer finance commentary on this life cycle notes that contract negotiations should be informed by risk assessment findings and legal and compliance perspectives working together, not sequentially. That kind of cross-disciplinary input is exactly what breaks down when a bank has generalists handling every stage instead of staff matched to the specific risk at hand.
Why Certification Records Work as the Evidence Examiners Are Asking For
A resume line saying "certified" is not proof by itself, but a maintained certification with continuing education requirements gives an examiner something concrete to check against the guidance's language. That's a meaningfully different artifact than a self-reported skills matrix, because it's issued and audited by a third party your bank doesn't control.
For risk officers responsible for the identification, assessment, and ongoing monitoring stages, a credential like ISACA's CRISC certification maps directly onto the enterprise risk and control competencies the guidance expects at those stages. It's built around identifying IT risk, assessing it, and designing the response and reporting structure a bank's committee and board actually need to see. That alignment matters when an examiner asks how you determined a given staff member was qualified to sign off on a critical vendor relationship.
If you're building out documentation for an upcoming exam cycle, it helps to walk through a full curriculum overview and see how domains map to the life cycle stages you're already using, which is exactly what the certification resources overview is designed to help with. Matching a credential to a specific stage of your third-party program, rather than treating certification as a generic box to check, is what turns training spend into examinable evidence.
None of this replaces the judgment your risk committee has to exercise. But when an examiner reviews your file and asks who assessed a vendor's cloud subprocessor risk, having a named, certified individual attached to that decision is a materially stronger answer than pointing to a policy document. If you want to build a study plan around closing that gap on your team, you can start training whenever you're ready.
What Should a Staffing File Actually Contain?
Most banks that fail this part of an exam don't lack qualified people. They lack a record showing the connection between a specific person, a specific life cycle stage, and a specific qualification. A defensible staffing file for third-party risk typically includes:
- A role-to-stage matrix naming who owns planning, due diligence, contract negotiation, monitoring, and termination for each critical vendor relationship
- Current certification and continuing education records for each named individual, refreshed on a schedule tied to renewal cycles
- A documented rationale for why that person's background matches the risk level of the relationships they oversee
- A gap log showing where staffing capacity was assessed and found short, along with the remediation plan and timeline
Building that file before an exam, rather than reconstructing it under deadline pressure, is the difference between a clean finding and a matter requiring attention. The OCC's original bulletin on the interagency guidance makes clear this guidance applies to all banks with third-party relationships, regardless of size, which means the staffing expectation scales down to community institutions just as much as it applies to large regional banks.
The Accountability Case for Treating This as a Staffing Decision, Not a Policy Exercise
Boards and executives often treat third-party risk as a documentation problem because the guidance itself reads like a documentation standard. But the FDIC's exam procedure and the Fed's own community bank guide both point to staffing as the control that actually gets tested. A written policy with no named, qualified owner behind each life cycle stage is a paper exercise waiting for an examiner to notice.
The practical fix is straightforward even if it takes time to execute. Identify who owns each stage of your third-party life cycle, confirm their qualifications against what that stage actually requires, and keep the records current enough that you can produce them on request rather than assemble them after the exam letter arrives.