Ongoing monitoring is a lifecycle phase, not an annual event

In June 2023, the Federal Reserve, the FDIC, and the OCC jointly issued the Interagency Guidance on Third-Party Relationships: Risk Management — OCC Bulletin 2023-17, FDIC FIL-29-2023, and Federal Reserve SR 23-4. It replaced three separate agency documents that had governed this area for a decade or more, including OCC Bulletin 2013-29 and the FDIC’s 2008 guidance, and gave the three agencies a single shared framework.

Most of the commentary at the time focused on what the guidance did not do: it did not create a safe harbor, it did not set a prescriptive checklist, and it did not lower the bar for smaller institutions. All of that is true, and all of it has been written about extensively.

The part worth more attention is structural, and it has a direct operational consequence: the guidance organizes third-party risk management as a lifecycle, and one phase of that lifecycle is doing far more work than most programs resource it for.

The five phases

The guidance frames the relationship in stages:

1. Planning — deciding whether and how to use a third party in the first place
2. Due diligence and third-party selection — evaluating the third party before committing
3. Contract negotiation — putting the expectations and rights into the agreement
4. Ongoing monitoring — the phase that runs for as long as the relationship does
5. Termination — exiting in a controlled way

Wrapped around all five are the governance expectations: oversight and accountability, independent reviews, and documentation and reporting.

Read as a sequence, four of those five phases are events. They happen once, they produce an artifact, and they end. Planning produces a decision. Due diligence produces an assessment. Contracting produces a signed agreement. Termination produces an exit.

Ongoing monitoring is the one phase that is not an event. It is a condition that persists for years, and the guidance describes it as work that continues throughout the relationship rather than something performed at intervals.

How it usually gets implemented

In practice, most programs implement ongoing monitoring as a calendar entry. The third party is assessed at onboarding, then reassessed annually — sometimes every two or three years for lower-criticality relationships — using substantially the same questionnaire that was sent the first time.

Between those reassessments, monitoring typically consists of whatever arrives unprompted: a breach that makes the news, a vendor’s own notification, a colleague mentioning that a service has been degraded.

There is a reasonable explanation for this. Continuous monitoring done manually is not a process, it is a headcount problem. Watching 200 third parties across financial health, cybersecurity, sanctions, legal, reputational, and regulatory exposure, then correlating what you find against the documentation on file, is not work that a two-person team absorbs alongside its other responsibilities. So the annual cycle persists, not because anyone believes it is sufficient, but because it is what fits.

Why the gap produces findings

The difficulty is that risk does not observe the review calendar. Between two annual assessments, a third party can lose a major customer, go through layoffs, have a lawsuit filed against it, lose a banking partner, or suffer a breach. In one recent fintech failure, the public warning signs were visible for more than six months before the collapse became impossible to ignore.

An institution operating on an annual cycle learns about all of it at the next review, if it learns at all. And the question an examiner asks is not whether you were monitoring. It is what your monitoring produced, and what you did with it.

That question is hard to answer well from an annual questionnaire, because the questionnaire produces a point-in-time snapshot of what the third party said about itself. It does not produce a record of continuous oversight. It produces evidence that you asked once a year.

What “proportionate” actually allows

One of the more useful aspects of the guidance is that it is explicitly risk-based. The depth of due diligence and the intensity of monitoring are meant to be proportionate to the risk and criticality of each relationship. There is no expectation that a landscaping contract receives the same scrutiny as a core processor.

This is often read as relief, and it is. But it cuts the other way too. If monitoring intensity is supposed to scale with criticality, then a program that applies the same annual questionnaire to everything is not actually risk-based. It is uniformly thin, and uniformly thin at the top of the criticality range is the part that shows up in an exam.

The practical implication is that programs need a way to do genuinely more for critical relationships without simply doing more work. That is a tooling question before it is a policy question.

Beyond banking

The interagency guidance applies to institutions supervised by the three banking agencies. Credit unions sit with the NCUA, which maintains its own third-party expectations and has repeatedly flagged third-party risk in its supervisory priorities — notably without the authority to examine third-party service providers directly, which places more of the burden on the credit union itself.

Outside financial services, the vocabulary changes but the structure does not. HIPAA business-associate oversight, supply chain risk practices built on NIST guidance, and ordinary internal audit expectations all ask variations of the same three questions: what diligence did you perform, what have you done since, and can you show the record.

Financial services simply asks them with an examiner in the room. That is why it is a reasonable standard to build to even when no examiner is coming — the discipline transfers, and the documentation burden is the same one every auditor eventually imposes.

The part that is actually hard

None of this is a knowledge gap. Risk teams know what ongoing monitoring is supposed to look like. They know the annual cycle is a compromise. They can usually name the relationships they would watch more closely if they had the capacity.

What is missing is the capacity, and specifically the capacity to do three things continuously that currently only happen in bursts: keep the documentation current, read it when it changes, and connect an incoming signal to what is already on file so that someone can tell whether it matters.

Do those three things continuously and ongoing monitoring stops being a calendar entry. It becomes what the guidance already describes: a phase that runs the length of the relationship.

---

This is a plain-English summary for practitioners and is not legal or compliance advice. Consult the source documents and your own counsel for how the guidance applies to your institution.