# How to Set a Risk Appetite Framework for Third-Party Relationships

By: [Hilary Jewhurst](https://www.venminder.com/blog/author/hilary-jewhurst) on February 6 2024

###### 8 min read

Have you heard the terms “risk appetite framework” or “risk appetite statement,” but aren’t sure what they are or how they relate to third-party risk management? In this blog, we’ll explore exactly what a risk appetite is, how it’s developed through a risk appetite framework, and the purpose of a third-party risk appetite statement.

## Understanding the Purpose of a Third-Party Risk Appetite Framework

Every organization that utilizes [outsourced products and services provided by third-party vendors](https://www.venminder.com/blog/third-party-risk-outsourcing-benefits) is exposed to certain risks. Regardless of the organization's size, it must be willing to take calculated risks to grow and remain competitive. These risks could include launching new products, entering new markets, or investing in new technologies. While there are potential downsides to taking risks, well-calculated ones can lead to significant rewards and long-term benefits for the organization. But how do organizations decide which [third-party risks](https://www.venminder.com/blog/what-are-third-party-risks) are acceptable and which are not?

As a best practice, the level of tolerable risk for the organization is usually determined through what’s known as a risk appetite framework. A third-party risk appetite framework is the methods, tools, and internal structures used to identify the level of risk an organization is comfortable accepting in pursuit of its goals and objectives through its use of third parties to deliver products and services to the organization or its customers.

To ensure safe and responsible decision-making, it's important for organizations to develop and follow a risk appetite framework. While some organizations are comfortable having an overall risk appetite framework that applies to all aspects of their business and operations, many organizations realize that the risks associated with using third parties may need a more tailored approach and develop a separate third-party risk appetite framework.

### Here’s what should be included in a third-party risk appetite framework:

1. **Governance and oversight** – Governance and oversight are the processes and structures put in place to ensure an organization's third-party risk appetite is effectively defined, communicated, and monitored. This includes the roles and responsibilities of key stakeholders, such as the board of directors, senior management, and the third-party risk management function.
2. **Standardized definitions of risks** – An organization’s overall risk appetite statement will generally include risks found in the SCORE model: strategic: strategic, compliance, operational, reputational, and economic risks. A third-party risk appetite statement should also include risks relevant to third parties, such as compliance, information security, cybersecurity, business continuity, or [concentration risk](https://www.venminder.com/blog/pros-and-cons-of-vendor-concentration-risk).
3. **Standardized levels of risk appetite** – Clear and standardized levels of risk appetite may look like the following:
   - **Risk seeking** – Open to aggressive risk taking
   - **Risk tolerant** – Willing to tolerate more than normal risk
   - **Risk neutral** – Strive for more balanced risk taking
   - **Moderately-risk averse** – Exercise caution in taking risks
   - **Risk averse** – Minimize risk as much as possible
4. **Defined risk appetite** – Thresholds indicate the level of risk that an organization is willing to take. These limits are defined in terms of risk appetite metrics and are used to monitor the organization's risk exposure.
5. **Risk metrics** – These are quantitative measures used to assess an organization's risk tolerance. These metrics can include financial ratios, key performance indicators, and risk scores, among others.
6. **Authorization guidelines for risk-taking at various levels** – It’s important to clearly identify who has the authority to accept risks based on their size and type. For minor third-party risks, it may be appropriate for the business unit to decide to take on some risk to achieve their objectives. However, in the case of significant risks that could have a major impact on the entire organization, only the board and senior management should have the authority to determine if those third-party risks are acceptable.
7. **Employee communication and training** – To establish an effective third-party risk management culture, it’s essential that employees understand their roles in managing risks. This can be achieved through regular communication and training.
8. **Risk reporting** – Third-party risks are constantly changing and evolving. [Regular reporting is necessary](https://www.venminder.com/library/third-party-risk-management-reports-maintain) to ensure the organization accurately captures its risk universe and keeps its risk-taking within the approved risk appetite.

## Developing a Third-Party Risk Appetite Statement

Every organization has its own unique quantitative and qualitative thresholds that determine its risk appetite. For instance, if an organization operates in a heavily regulated industry, it might have an exceptionally low appetite for compliance risk, which is especially true for third-party relationships that provide products and services subject to specific [laws and regulations](https://www.venminder.com/library/third-party-risk-management-regulations-guidance). On the other hand, a technology company that is looking for innovative and new solutions may be willing to accept more financial losses while pursuing research and development. This could lead to choosing a third party that offers a relatively new and untested product. A third-party risk appetite statement guides an organization on the risks present and the risks that may be taken in the selection, use, and management of third parties.

### An effective third-party risk appetite statement typically includes the following:

- **Your corporate values**, which state your willingness to accept and mitigate certain risks.

**Example third-party risk appetite phrasing:** _“XYZ Organization will act in accordance with the third-party risk appetite statement to ensure the use of third-party vendors and providers that offer products or services to our organization or customers on our behalf aligns with the organization's strategic goals and objectives, protects organization and customer data and assets, complies with all rules, laws, and regulations, and safeguards the organization’s reputation and brand.”_
- **A clear description** of your organization's overall attitude and approach to risk.

**Example third-party risk appetite phrasing:** _“The organization understands its duty to manage risks associated with third-party relationships and takes responsibility for it. To do this effectively, the organization considers various factors such as regulatory requirements, industry best practices, and customer expectations. Moreover, the organization takes into account its internal goals, available resources, and the need to identify, manage, and monitor third-party risks effectively. The organization has set the acceptable level of risk for each risk domain and determined the level of authority necessary for taking these risks.