Fourth-Party Risk

A firm contracts with a vendor, but the vendor in turn buys hosting, software, staffing or logistics from others. Those are fourth parties, and their suppliers are fifth parties, which is why the wider idea is called Nth-party risk. A failure or breach at any link can reach the firm even though it never chose or assessed that link. Common problems are hidden concentration, where many vendors use the same cloud provider, weak security at a small subcontractor, and work moved to another country without notice. Firms manage this by asking vendors to list material subcontractors, writing flow-down terms into contracts, requiring notice of changes and, for key suppliers, mapping the chain. Full visibility is rarely achievable. Customers and regulators hold the firm answerable for the whole chain, including links it never chose.

A hospital uses a billing vendor. Unknown to the hospital, the vendor stores patient files with a small hosting company. That company suffers a ransomware attack and the files are locked. The hospital has no contract with the host, but patients and the regulator hold the hospital accountable for the exposure.