Executive search for heads of third-party risk

Outsourcing, as the PRA defines it in SS2/21, is an arrangement under which a service provider performs a process, a service or an activity that the firm would otherwise carry out itself.

The head of third-party risk owns the oversight of everything inside that definition: the register, due diligence before signing, monitoring after it, and the notifications to the PRA, which expects to hear before a firm enters or significantly changes a material outsourcing arrangement. Accountability sits higher up. SS2/21 is blunt that senior managers cannot outsource their responsibilities, and outside small firms one of them holds PR X, the prescribed responsibility for the firm’s obligations under outsourcing.

It is not a senior management function, so it is usually a certification function, certified by the firm as fit and proper each year rather than approved by the regulator. It sits in the first line under the chief operations officer, SMF24, or in the second line under the chief risk officer, SMF4, in a risk function the PRA requires to be independent of the operational functions. The first question we settle in a brief is which senior manager holds PR X, and whether this hire does that work for them or challenges it. The answer changes who we approach.

Sources: PRA SS2/21, November 2024, paragraphs 2.1, 4.3 and 5.14; PRA Rulebook, Allocation of Responsibilities Part, rule 4.1(21), Senior Management Functions Part, rules 3.4 and 3.8, Risk Control Part, rule 3.4, and Certification Part, rule 2.1.

Strong candidates come from four places: sitting heads of third-party or supplier risk at other regulated firms, whose framework has been through a supervisory visit; deputies who have run the register and the notifications and are ready to own the function; people crossing from procurement or vendor management, who know the contracts but have not held a second-line standard; and, less often, people from operational resilience, consulting or the regulator.

We test hardest for two things. Whether the person can say, without notes, what the firm would do in the month after its most important supplier failed. And whether they have held a line with a chief operations officer who wanted the contract signed that week, and kept the relationship.

Then scale. A head of third-party risk from a large bank has run one part of a programme with a team of specialists and a tooling budget; in a smaller firm the same person writes the policy, does the due diligence and presents to the risk committee with two analysts. The size of the register they ran tells you more than the title.

• The brief describes a procurement job with a risk title, or the reverse: the firm wants someone to own supplier due diligence and contract terms, then measures them as a second line. Settle which before the first approach; the two pools barely overlap.
• PR X sits with a senior manager the head of third-party risk rarely meets. Senior managers cannot outsource their responsibilities, and when two layers of management separate the accountable one from the person doing the work, notifications go in late.
• The step-in question is left to finance. Since 1 January 2026, banks outside the SDDT regime must identify and assess step-in risk, and the PRA’s definition of an unconsolidated entity takes in suppliers under material outsourcing arrangements, so the outsourcing register now feeds a return that goes in with the ICAAP. The candidate who has seen that link is a different hire.

Sources: PRA SS2/21, November 2024, paragraph 4.3; PS5/25, 22 April 2025, paragraph 1.15; PRA Rulebook, Step-in Risk Part, rules 1.1 and 6.1, Regulatory Reporting Part, rule 24.5, and Glossary.