In June 2023 the Federal Reserve, the FDIC and the OCC issued final Interagency Guidance on Third-Party Relationships: Risk Management. It replaced the agencies’ prior separate guidance with a single framework. For a vendor management office, the practical effect was not a new list of clauses to negotiate. It was a raised expectation that the control environment around those clauses can be demonstrated.
The guidance describes a lifecycle: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination. Contract negotiation sits in the middle of that lifecycle rather than at the end of it. What gets written into an agreement determines what can be monitored afterward, and what can be evidenced when somebody asks how the relationship is managed.
This datasheet sets out what a contract control environment should produce. It is organized the way a first-line control owner works, provision by provision, with the field that holds it, the cadence that tests it, and the artifact that proves it. The framing is capability, not compliance theater.
What the interagency guidance actually asks for
The guidance is guidance, not a rulebook, and it is explicitly risk-based. It does not prescribe a single contract template or mandate identical treatment of every supplier. It sets expectations that scale, with more rigor applied to higher-risk relationships and to those supporting critical activities. That structure is helpful for a vendor management office, because it makes tiering a control in its own right rather than an administrative convenience.
- Nature and scope of the arrangement, written specifically enough that a reviewer can tell what is in scope, what is excluded, and which of the bank’s activities depend on the service being delivered.
- Performance measures and benchmarks, expressed as targets a monitoring team can test, with the reporting the third party owes and the consequence when a benchmark is missed over consecutive periods.
- Responsibilities for information, covering what each party must provide and receive, on what schedule, so that reporting gaps surface as control exceptions rather than as surprises at renewal.
- Audit and remediation rights, granting the right to audit or receive audit reports and the right to require remediation of identified issues, with the timeframe and escalation path stated.
- Continuity, confidentiality and integrity, addressing business continuity and resilience expectations alongside the confidentiality and integrity of bank and customer information handled by the third party.
The guidance also discusses indemnification, insurance, dispute resolution, subcontracting, and default and termination. Those provisions are familiar to any contracts team. What is less familiar is being asked to show, across several hundred active agreements, which ones carry each provision, in what form, and who watches it. That question is answered by a data model, not by a document repository.
A control environment that applies identical rigor to a landscaping vendor and a core processor is not stronger, it is less credible. Tier relationships on inherent risk and criticality, then bind template selection, approval routing, monitoring cadence and evidence retention to the tier. The tier becomes a field on the record, and every downstream control reads from it.
Capabilities the contract control environment must provide
A datasheet is a statement of what the system does. For vendor contract controls, five capabilities carry the weight. Each one exists to shorten the distance between a question and a defensible answer, whether the question comes from an examiner, internal audit, the board risk committee, or a business owner who wants to know what the bank agreed to.
- Provision-level extraction across the executed portfolio. Each agreement is parsed for the provisions the control matrix names, returning present, absent or weak for every one. That converts a document library into a queryable population you can report on.
- Tiering that drives template and approval routing. Inherent risk and criticality set the tier at intake. The tier selects the template, the required provisions, the approver set and the monitoring plan, so proportionality is enforced by configuration.
- Obligation tracking after signature. Reporting duties, audit rights, insurance certificates and remediation commitments become dated tasks with owners. Monitoring stops depending on whoever remembers the relationship and starts producing a record.
- Exception reporting instead of periodic panic. Missing provisions, lapsed certificates, overdue third-party reports and expiring agreements surface continuously. The vendor management office works a queue rather than reconstructing a year of activity.
- Evidence retrieval with lineage. For any provision, the system returns the clause text, the source agreement, the amendment history and the monitoring record. Retrieval time is the control that examiners feel most directly.
A five-step rollout for the control matrix
Step 1, Define The Provision Set
Agree the provisions your matrix will track, drawing on the categories the guidance discusses and on your own risk appetite. Keep the set short enough to maintain and specific enough to test. Have second line and internal audit sign off on the definitions before configuration begins, not after the first report.
Step 2, Tier The Third-Party Population
Score inherent risk and criticality for every active relationship, then assign a tier. Document the scoring method so the tier is reproducible. Tiering is the control that makes proportionality defensible, and it is the field every other control reads, so it is worth the effort to settle it early.
Step 3, Extract And Baseline Executed Agreements
Run the provision set against signed contracts and record present, absent or weak for each. The first pass gives you a coverage baseline by tier. Expect the highest-tier population to be in better shape than the middle, where relationships have grown in importance without the paper keeping up.
Step 4, Attach Monitoring To Provisions
Turn every testable provision into a scheduled obligation with an owner, a cadence and an expected artifact. Insurance certificates and third-party assurance reports are the usual starting point because they expire on a known date and their absence is unambiguous.
Step 5, Publish The Evidence Pack
Build a standing report that produces the matrix on demand, by tier and by relationship. Run it monthly for internal review so the exam version is the same artifact your team already reads. A report that only appears under examination will not be trusted by the people producing it.
See the vendor contract control matrix in practice
Walk through provision extraction, tiering, obligation tracking and the evidence pack on a live third-party portfolio, using your own contract population and control definitions.
What an examiner asks for, and where the answer lives
Requests tend to follow a pattern. Give us the third-party inventory with risk ratings. Show the contract for these five relationships and point to the audit and termination provisions. Show how performance against the agreed measures has been monitored for the last four quarters. Show what happened when a benchmark was missed. Each of those is answerable in minutes when provisions carry structured fields, and it takes a week when the answer lives inside signed PDF files. Teams that already automate third-party risk contract review tend to answer from a report, and the follow-up questions get shorter.
The control matrix, provision by provision
The matrix below is the deliverable. Each row states the provision, the field that holds it in the system of record, how often the control is exercised, and the artifact produced. Post-signature duties move into obligation management, and the same discipline supports financial reporting work described in a SOX and third-party risk exam checklist.
| Contract provision | System of record field | Monitoring cadence | Evidence artifact |
|---|---|---|---|
| Nature and scope of arrangement | Service scope, dependent activity | At renewal and on change | Clause extract and scope attestation |
| Performance measures and benchmarks | Target, method, breach remedy | Monthly or quarterly | Scorecard against agreed benchmark |
| Audit and remediation rights | Audit basis, remediation window | Annual and event driven | Assurance report and remediation log |
| Business continuity and resilience | Recovery expectation, test duty | Annual test cycle | Test results and continuity plan |
| Insurance, indemnity and termination | Limits, expiry, notice period | Continuous expiry watch | Certificate of insurance and notice record |
Contract provisions are only half of a control. The other half is the routine that tests them and the artifact that survives the conversation. A vendor management office that can produce the matrix on a normal Tuesday is not preparing for an examination, it is running a control environment that an examination happens to observe. That is the difference between an evidence problem and a reporting exercise, and it is built before anyone announces a review.
For related guidance, see OCC and FFIEC vendor oversight, the contract controls, Bank fintech partnership agreements, the control questions and Complementary user entity controls in vendor contracts.
