Third-Party Risk Management

Hi Nirupama. This is a great question. First, depending on which department is conducting the initial screening, it is important to ensure a segregation of duties when it comes to clearing red flags. For example, if the operations department runs the entity through the initial screening database and the search yields red flags, the adverse results should be escalated to a mid-level manager outside of the operations department (e.g. compliance or legal). If the red flags present relatively low risk, it is fine to give the (adequately trained!) mid-level manager authority to bless the transaction. However, as you noted, it is very important to document the rationale behind the decision. If the mid-level manager determines that circumstances present higher risk, he or she should elevate to the compliance officer/GC. If at that point the compliance officer or GC is apprehensive about making the call, it is always smart to obtain an advise of counsel memorandum for your files. Outside counsel may provide mitigation recommendations as part of the documentation in order to further protect the company. Hope this helps!

Thank you, Jacqui!