Hand pull important color block from balance wooden stack.

How to manage third-party risk in the public sector

How to manage third-party risk in the public sector

3 Minute Read

Organizations in the public sector face unique risks when they contract with a third party to deliver their services. If these risks are not managed properly, they can result in the delay of essential services and cause the public to lose trust in their government.

To mitigate these risks, organizations in the public sector should set their expectations before entering a relationship with a third party, ensure they provide the right oversight throughout the duration of the contract, have a backup plan if the third party fails to meet expectations, and follow the risk management lifecycle to protect their organization.

Partner, Consulting
Senior Manager, Enterprise Risk Services

Public sector organizations rely on third-party services to improve efficiency, enhance cost effectiveness, and meet the needs of their stakeholders. However, third-party services also pose unique risks to organizations operating in the public sector.

Public sector organizations need the tools and methods to identify, assess, and manage risks when contracting with third parties to deliver services, ensuring the appropriate measures are in place to protect themselves and the communities they serve.

What is third-party risk?

A third party is a vendor, contractor, affiliate, or any other external party contracted by an organization to meet operational needs and achieve desired outcomes. Organizations often use third parties to improve efficiency, enhance productivity, and reduce the cost of services.

While the use of third parties provides many benefits, it also increases exposure to risks such as:

  • Cyber attacks and data breaches
  • Operational disruptions
  • Regulatory issues and liability exposures
  • Reputational damage

These risks stem from errors, vulnerabilities, or mismanagement by the third party. If these risks are not properly managed, they can result in legal, financial, strategic, security, reputational, and operational damages.

How does third-party risk affect the public sector?

While all organizations experience some level of exposure to third party risks, the unique operating environment of the public sector — with ever-growing levels of stakeholder expectations and external scrutiny — creates conditions where failing to plan appropriately for these third-party risks has unique consequences, including:

Delay in essential services

A failure to address third-party risk exposes your organization not only to financial loss but could also interrupt services that support community well-being, including healthcare, food services, infrastructure maintenance, and more.

Reputational damage

A delay in services isn’t the only consequence if a third party fails to perform to the standards public servants and stakeholders expect — it also damages the public’s trust in the government and can also have political consequences.

Enterprise Risk

You’re navigating an increasingly unpredictable business environment. We provide strategies and solutions to help you turn risk into a competitive advantage.

How to limit third-party risk in the public sector

Your organization must take steps to mitigate third-party risks to protect against delays in essential service and reputational damage. While it is not possible to fully eliminate third-party risks, ensuring that the appropriate measures, contracts, and oversight are in place can reduce or minimize third-party risks and maintain transparency and accountability in the public sector.

Consider the following best practices:

Follow applicable directives

Governments operating at the municipal, provincial, and national level are subject to directives that guide all decisions when contracting with third parties. These directives are intended to ensure accountability and transparency throughout the process.

For example, the Directive of Management Procurement directs how third-party assets are procured to support the delivery of services to Canadians. The directive includes guidelines around risk management and procurement decisions to achieve operational outcomes.

Your organization might also be subject to additional regional directives. For example, the Transfer Payment Operational Policy in Ontario applies to departments at the provincial and municipal level. It sets the operational requirements and accountability framework for transfer payments to external recipients, including third parties contracted to deliver services.

Set expectations

It is essential to set clear expectations when your organization contracts a third party to deliver services in the public sector. Determine key performance indicators (KPIs) such as strategic, operational, and performance goals and identify the desired outcomes of the contract before entering an agreement with a third party.

Ensure the right oversight

After the expectations for the third party are determined, your organization should ensure it has the appropriate structures in place to oversee the delivery of the outsourced services.

Monitor and report on results on a regular basis to track performance and ensure the third party is meeting objectives. You can choose to either renew, update, or terminate the contract after it expires based on whether the third party was able to achieve the desired outcomes.

Have a backup plan

Consider contracting multiple vendors to supply the same services. These backups are essential to prevent a delay in services and minimize reputational damage if one vendor does not meet expectations and is released from their contract.

Follow the third-party risk management lifecycle

Keep the third-party risk management lifecycle in mind when outsourcing services to a third party. The third-party risk management lifecycle can be tailored to address the specific risks faced by public sector organizations and includes:

  • Identification and due diligence — Identify and assess the third party to determine the criticality and level of risk exposure posed by the potential relationship.
  • Contracting and onboarding — Establish the parameters for the relationship’s success. Both parties will agree on the risks to be managed and how they will be distributed, the terms for data ownership and transfer (if any), the scope of services to be delivered and delivery methods, Service Level Agreements, penalties for non-performance, and subcontracting rules among many others.
  • Performance monitoring — Monitor third parties by tracking agreed upon service levels and the supporting KPIs to ensure service delivery meets or surpasses expectations.
  • Evaluation and offboarding / renewal — Consider the cost, regulatory changes, quality of services, and overall relationship with the third party to determine if the contract will be renewed, updated, or terminated.

Read Understanding third-party risk management for more information about the third-party risk management lifecycle.

Take the next steps

As the post-COVID landscape continues to grow and change, organizations in both the private and public sector are becoming increasingly more reliant on third parties. While third parties can support modernization efforts and the implementation of new systems, they also pose specific risks to organizations in the public sector.

Public sector leaders should be mindful of the risks of contracting with third parties and the consequences if those risks aren’t properly managed. An advisor can help you set up a third-party risk management framework to protect your organization and better manage risk exposures created by third parties.

Contact an MNP Enterprise Risk advisor for more information if you need help setting up a third-party risk management framework. Our advisors will work with you to identify and address the threats across all areas of your organization.

Contact us

Héloïse Bédard MSc, CIA, CRMA, CGAP, PMP

Partner, Enterprise Risk Services


  • Performance

    April 16, 2024

    Software in British Columbia: Taxation in perpetual motion

    What software is taxable in British Columbia for PST purposes? Discover the changes introduced in the province’s 2024 budget.

  • Performance

    April 16, 2024

    2024 Federal Budget Highlights

    View MNP’s full tax analysis of the 2024 federal budget.

  • Progress

    Your farm succession plan isn’t complete until it exists in writing

    The average age of farmers in Canada is increasing. Having a written succession plan becomes more important as you age, to help secure your legacy, protect your farm operation, and reduce conflict.