Third party risk management: a program that covers geopolitical risk

Most programs follow the same five stages. Planning decides whether to use an outside party at all and what could go wrong. Due diligence checks the party before signing. Contracting sets rights to information, audit, notice of incidents and exit. Ongoing monitoring tracks performance and risk changes. Termination plans how to exit without disruption.

The stage most programs underinvest in is the last one. An exit plan written before trouble starts is what lets a company move quickly when a war, a sanctions package or a closed border cuts off a key provider overnight, as many found with Russia in 2022.

In the US, banking regulators issued joint guidance on third party relationships on June 6, 2023. It applies to supervised banks and asks for risk management scaled to the bank's size, complexity and the criticality of each relationship. In Canada, OSFI Guideline B 10 sets similar expectations for federally regulated financial institutions and has applied since May 1, 2024.

In the EU, the Digital Operational Resilience Act has applied since Jan 17, 2025. Financial firms must keep a register of their technology third parties, and the most important providers face direct oversight. Outside finance, forced labour reporting in Canada and import rules in the US push manufacturers and retailers toward the same kind of documented due diligence.

Record where each third party actually delivers the service or makes the goods, not just where it is incorporated. A software vendor with developers in one country, data centers in another and a parent company in a third carries three sets of country risk. Map concentration: how many critical parties depend on one country, one cloud region, one port or one sea route?

Screen ownership, not just names. Sanctions and export controls increasingly follow ownership chains, so a distributor or customer that is majority owned by a listed party can create exposure even if its own name is clean. Write geopolitical scenarios into exit plans: a sudden sanctions package, a conflict that cuts internet or shipping links, or export licensing that halts a key input.

Annual questionnaires miss fast moving risk. In 2026 a strait closed, insurance terms changed weekly and export rules moved on political deadlines. Programs that relied on yearly reviews learned about the impact from their own operations teams.

Add trigger based reviews. Useful triggers include a country moving into a higher risk band, a new designation affecting an owner, a chokepoint closure on a key route, a change in export controls, a cyber incident at a provider, or a merger. Each should flag the affected third parties automatically so the review starts the same week.

Fourth parties are the most common blind spot: the providers your providers rely on. Ask critical third parties to name their own critical suppliers and locations. A second gap is treating TPRM as a procurement form rather than a risk decision, so findings never reach the business owner.

A third gap is ignoring the downstream side. Distributors, agents and resellers can create sanctions, export control and corruption exposure just as easily as suppliers. A complete program covers both directions.