The best way to manage fourth-party and Nth-party risk is to ensure the third-party vendor has a robust and mature TPRM program of its own. This involves assessing the third party's ability to manage its own vendors (your fourth parties). An organization should review the third party's TPRM policies, procedures, and due diligence evidence for its critical subcontractors. Contractual agreements must include clauses that provide the right to assess these controls and require notification of any significant changes in the subcontracting relationship. This approach creates a scalable, cascading chain of responsibility and oversight throughout the entire supply chain.

A: Directly assessing every fourth party is operationally infeasible due to the sheer volume and the typical lack of a direct contractual relationship.

B: Ignoring fourth-party risk is negligent. Regulatory bodies hold organizations accountable for the risk to their data, regardless of where it resides in the supply chain.

D: Relying solely on a third party's contractual attestations without any verification provides no meaningful assurance that risks are being managed effectively.

1. Shared Assessments, "Vendor Risk Management Maturity Model (VRMMM)." A mature TPRM program, as defined by the VRMMM, includes processes for managing and monitoring subcontractor (fourth-party) risk.

2. Office of the Comptroller of the Currency (OCC), "OCC Bulletin 2013-29: Third-Party Relationships: Risk Management Guidance," Page 12. This guidance requires banks to conduct due diligence on a third party's ability to manage its own subcontractors.

3. Shared Assessments, "Managing Fourth-Party Risk" White Paper. This official publication details the best practice of evaluating a third party's own risk management program as the primary method for managing downstream risk.