Third-party risk

Outsourcing the work does not outsource the consequence.

If a supplier's failure stops your service or exposes your customers' data, it is your incident, your regulator and your reputation. The contract may determine who pays eventually and it does not change who has to respond on the day. This is the sentence most third-party risk programmes exist to operationalise.