Examiners do not read your contracts for pleasure. They read them to see whether third party risk management actually reaches the agreement, and whether the agreement gives the bank what it needs to monitor, audit, recover and exit. The 2023 interagency guidance on third party relationships, issued jointly by the Federal Reserve, the FDIC and the OCC, is explicit about the role of contract negotiation in that chain.
That guidance is principles based. It replaced the separate statements the three agencies had issued previously and describes sound practices across the life cycle of a third party relationship: planning, due diligence and selection, contract negotiation, ongoing monitoring and termination. It does not publish a list of mandated clauses. The FFIEC examination handbook covers similar ground for technology service providers, and credit unions work to NCUA expectations, but the clause areas converge.
What follows is a working index of those clause areas, phrased the way reviewers tend to probe them. Treat it as a drafting and review aid rather than a legal standard, and confirm specifics with counsel. What matters is that when a clause is missing, the bank usually cannot evidence the control that depends on it.
The clause areas examiners keep returning to
Risk based expectations mean the depth of contract terms should track the risk and criticality of the activity. A critical activity supported by a provider with access to customer data warrants tighter drafting than a low risk service. The areas below are where reviewers concentrate once an activity is judged critical.
- Scope, roles and responsibilities, what the third party will do, what the bank retains, which party supports customers, and where accountability sits, written precisely enough to test against actual delivery.
- Performance measures and benchmarks, service levels with defined metrics, a measurement method, a reporting cadence and consequences for shortfall, rather than a promise of commercially reasonable efforts.
- Audit rights and access to reports, the right to audit or to receive independent control reports with remediation status, and provision for supervisory access to records held by the provider.
- Information security and incident reporting, security requirements, notification timelines for incidents affecting the bank or its customers, and cooperation duties during investigation and customer notification.
- Resilience, subcontractors, law, insurance and exit, continuity and recovery commitments, oversight and consent over subcontractors, compliance with applicable law, insurance coverage, default triggers, termination rights and transition support.
Each area maps to an examination request that asks for evidence across a population, not a single file. A request looks like this: show every contract supporting a critical activity, and identify which give the bank audit rights. A repository holds documents while contract lifecycle management holds terms, and that difference decides how long your answer takes.
A reviewer asking about audit rights is testing whether the bank can identify, across its whole third party population, which agreements grant them and which do not. If that answer requires opening documents, the review becomes a sampling exercise and the sample defines the finding. If it comes from an indexed clause field, the answer arrives with the contract list attached.
Why a clause level index beats a document repository
A document repository answers questions about documents: what exists, when it expires, who signed it. Examination requests are about terms. Which agreements include a right to audit. Which require incident notification inside a defined window. Which permit subcontracting without consent. Those are attributes of clauses, and they have to be extracted and stored as data before anyone asks.
- Coverage becomes measurable. A clause index shows the share of critical vendor agreements containing each expected term, so a gap is a number on a report rather than an anecdote from a review.
- Remediation gets a queue. Missing or weak clauses become tracked items assigned to a contract owner, with a target date tied to the next renewal or amendment window.
- Playbooks stop drifting. Fallback positions live next to the clause they apply to, so a negotiator under time pressure reaches for approved language instead of drafting something new.
- Monitoring inherits the terms. Reporting cadences, audit rights and continuity test commitments become obligations with owners and due dates, which is how contract terms turn into ongoing monitoring.
- Evidence sits with the clause. Control reports, test results, incident notices and insurance certificates attach to the provision that required them, so a documentation request becomes a lookup.
A five step roadmap for clause level exam readiness
Step 1, Fix the population first
You cannot index clauses in contracts you cannot find. Reconcile the vendor master, accounts payable spend and legal files into one list of third party relationships, then attach the governing agreement, amendments, order forms and data protection addenda to each. Expect surprises in the tail, particularly business managed subscriptions that never reached procurement.
Step 2, Rate criticality and risk
Rate each relationship by criticality and inherent risk using the factors your framework already applies: customer data access, transaction processing, regulatory activity, resilience dependence and concentration. Depth of contract review should follow that rating. Reviewers look for a defensible method applied consistently, not a uniform level of effort spread thinly across every supplier.
Step 3, Extract clauses, not summaries
Capture the clause areas as structured fields with a status of present, partial or absent, plus the parameters that matter: notification window, audit frequency, recovery time objective, liability cap, insurance limits and termination notice. AI assisted review makes this practical across hundreds of agreements, with a reviewer confirming exceptions rather than reading everything.
Step 4, Remediate at renewal
Sequence remediation by risk and by commercial opportunity. Critical relationships come first, then anything with a renewal, amendment or price change in flight, because that is when a counterparty will accept new language at little cost. Record each requested change as an item with an owner and a date so the queue survives staff turnover.
Step 5, Convert terms into monitoring
Turn the clauses you negotiated into running obligations. A quarterly control report, an annual continuity test, a defined incident notice duty and an insurance certificate renewal are all commitments with owners and dates. Ongoing monitoring then becomes a report of obligations met with evidence attached, which is the form reviewers find easiest to accept.
See the clause index on your own contracts
Bring a sample of vendor agreements spanning critical and non critical activities. We will show the clause level coverage view, the remediation queue and the obligations that carry terms into monitoring.
How to run the population review
Run the review as a repeatable pass rather than a one time project. Start with the critical population and the clause areas above, record coverage, then work down the risk tiers. Report coverage by clause area and by business owner, because business owners negotiate the renewals. Our guide to third party risk contract automation sets out the workflow, and this third party risk and exam readiness checklist covers the evidence a reviewer asks for.
Clause areas, exam probes and controls
The table below pairs each clause area with the question reviewers tend to ask, the drafting pattern that signals weakness, and the control worth adding. It works as a review template for one agreement and as the column set for a population scan.
| Clause area | What examiners typically probe | Weak drafting signal | Control to add |
|---|---|---|---|
| Scope and responsibilities | Whether the contract matches the service delivered | Scope defined by reference to a proposal | Scope schedule reviewed at renewal |
| Performance measures | How service levels are measured and enforced | Commercially reasonable efforts, no metric | Defined metrics, cadence and remedies |
| Audit and reports | Whether the bank receives and reviews control reports | Reports made available on request only | Named report types with delivery dates |
| Security and incidents | Notification timing and cooperation during an incident | Prompt notice, no deadline or channel | Defined notification window and contact |
| Subcontractors and exit | Visibility over subcontracted work and exit support | Silence on subcontracting, no transition | Consent rights, subcontractor list, exit plan |
Principles based supervision does not make the expectations vague. They are specific about outcomes: know your third parties, contract for the rights you need, monitor what you contracted for, and be able to show it. Clause level contract data is the part most institutions are missing, and it is the part that turns an examination request into a report.
For related guidance, see Vendor contract controls for OCC and FFIEC exam readiness, Complementary user entity controls in vendor contracts and Reg S-P service provider oversight: a contract guide.
