Article
Who owns third-party risk in a small team?
Assign supplier-risk work, decision authority and escalation across service owners, procurement, specialists and risk, using a worked responsibility matrix.
Contrata editorial team · Published · Prepared on
Give each supplier service an owner who understands its operational use, then assign the work and authority for each decision. The risk team can coordinate the programme and challenge evidence. It should not become the default owner of every supplier problem because it maintains the register.
A small team needs a workable handoff: who gathers the facts, who challenges them, who can accept the remaining risk and who acts if the answer arrives late. Job titles alone will not provide that handoff.
For APRA-regulated entities, CPS 230 makes the Board ultimately accountable for oversight of operational risk management and requires clear senior-management responsibilities, including service-provider arrangements. The matrix below is a suggested working design, not an APRA-prescribed allocation. It can also help organisations outside APRA's scope assign supplier-risk work under their own policies.
Start with the service, then name the decision
“Finance owns this supplier” is ambiguous if the same provider supports payroll, claims payments and document storage. Identify the arrangement and service before assigning ownership. One commercial relationship can need several operational owners and a coordinating contact.
Name a role and a current person against each important decision. Record their deputy, delegated authority and escalation route. A person can hold several roles in a small organisation, but that does not make every combination appropriate. Consider conflicts and who will provide effective challenge.
Use the provider-register maintenance guide to connect those responsibilities to the correct provider and arrangement records.
A responsibility matrix people can actually use
In a RACI matrix, R usually means responsible for doing the work, A accountable for the activity or decision, C consulted and I informed. Define those terms locally. The table uses plain role descriptions so a reader can see the proposed handoff without decoding letters.
| Decision or activity | Person doing the work | Decision authority or accountable role | Input and retained record |
|---|---|---|---|
| Define the proposed service and its use | Business sponsor or service owner | Manager authorised to sponsor the service | Procurement and specialists; service scope, data and dependencies |
| Assess the arrangement | Named assessment lead | Assessment owner under the approved policy | Service owner, security, privacy, legal or other relevant specialists; sources and unresolved gaps |
| Commit to a contract | Procurement or commercial lead coordinates | Contract signatory within delegated authority | Legal and service owner; agreed terms and any separate risk decision |
| Accept a residual risk or exception | Service owner proposes a response | Risk acceptor authorised for that exposure | Risk and relevant specialists; limits, conditions, expiry and escalation |
| Monitor service changes and performance | Service owner with assigned contributors | Named owner of the monitoring activity | Supplier and risk; signals, review triggers and actions |
| Close a remediation action | Action owner supplies evidence | Closure authority defined for that action | Relevant specialist verifies the result; scope of closure and remaining gaps |
| Exit or renew | Service owner coordinates the plan | Authorised renewal or exit decision-maker | Procurement, technology and legal; notice, transition and access/data evidence |
This is an example, not a universal allocation. The same person might coordinate assessment and procurement; authority to sign a contract still does not automatically confer authority to accept every risk. Where the policy reserves a decision to a committee or Board, a row in a worksheet cannot delegate it away.
Work an incomplete handoff
Consider a fictional insurer assessing a document-processing service. Its operations manager owns the service. Procurement manages the commercial process. A security reviewer discovers that privileged support access remains unclear.
The assessment lead records the gap and asks the supplier a precise question. The service owner explains the operational consequence of delay and proposes a temporary restriction. Security reviews whether that restriction addresses the particular concern. The authorised risk acceptor decides whether the proposal can proceed within their authority, with conditions or further escalation.
The procurement lead does not mark the security concern resolved because the contract is ready. The risk coordinator does not accept it simply because the supplier response is in the assessment file. If no authorised decision arrives before the commitment point, the service owner follows the agreed escalation route and the applicable hold condition.
Keep the source, response and unresolved condition attached as work moves between people. The decision-record guide shows how to distinguish evidence, advice and the final decision.
Make absence and disagreement part of the design
A deputy needs the evidence and sufficient authority, not just an inbox rule. Test a handoff while the primary owner is unavailable: can the deputy find the current source, explain what is still unknown and reach an authorised decision-maker before the relevant deadline?
Agree what happens when specialists disagree. Preserve the disagreement in the decision pack, identify who resolves it and escalate exposures beyond that person's authority. Avoid changing an assessment answer to make the workflow appear complete.
For each open action, record an owner, next step, agreed due date and the event that would bring escalation forward. Choose timing for the actual consequence; this article does not prescribe a universal review cycle or response deadline.
Keep audit independent of operating decisions
The IIA's Three Lines Model distinguishes management roles from independent internal-audit assurance. Use that distinction when allocating responsibilities. Internal audit should not become the owner of the supplier decision it may later assess.
Our internal-audit outsourcing review guide explains how to bring challenge into a proposal without treating an audit review as approval. APRA's CPG 230 provides implementation guidance; it does not itself create enforceable requirements.
What does L1, L2 or L3 mean in risk management?
Check the document's definitions. L1, L2 and L3 can describe successive levels of a risk taxonomy, such as a broad category and increasingly specific risks. In other contexts, people use similar labels for responsibility lines. Taxonomy depth and the Three Lines Model answer different questions: what risk is being described, and how responsibilities and assurance are organised. Do not infer a person's approval authority from either label without checking the organisation's delegations.
Check the next real supplier decision
Choose an upcoming renewal or assessment. Ask the service owner, assessment lead and decision-maker separately who can accept the open risk and what happens if that person is away. Resolve inconsistent answers before the commitment date. Save the agreed allocation with the arrangement record and test the next handoff against it.