What is Fourth-Party Risk Management?

Fourth-party risk management (FPRM) is an extension of third-party risk management (TPRM) and refers to the process of identifying, assessing, and mitigating the risks associated with an organization's fourth-party relationships. In essence, fourth-party risk management deals with the risks posed by the vendors and subcontractors of an organization's third-party service providers.

To provide a clear understanding, let's break down the relationships involved:

First Party: This is the organization itself, which seeks to procure goods or services from third-party vendors or service providers.

Third Party: The organization directly contracts with vendors or service providers to provide goods or services. This is the primary focus of traditional third-party risk management (TPRM).

Fourth Party: Fourth parties are the vendors, subcontractors, or partners that the third-party service provider may engage with to fulfill their contract obligations with the organization. These fourth parties are indirectly connected to the organization.

Return to Ecosystem Terminology Glossary