# 14. Can the third-party risk workflow explain a business-service dependency—not just a vendor score?

**A good answer should connect suppliers to the services and decisions that matter to the buyer.** Ask what happens operationally when a critical dependency deteriorates.

**Why it matters to buyers.** The federal agencies’ community-bank guide includes due-diligence considerations covering subcontractors, operational resilience, capabilities and service performance. It also addresses continuity and access to information in contracting. These considerations provide a useful interview foundation; the guide is a voluntary resource rather than a new set of legal requirements. ([federalreserve.gov](https://www.federalreserve.gov/frrs/guidance/third-party-risk-management-a-guide-for-community-banks.htm?utm_source=openai))

**Put it to:** Gregory Rasner, with procurement and the relevant business-service owner.

**A strong answer should cover:**
- The service supported, accountable owner and reason the relationship matters.
- Material subcontractors and shared dependencies, with unknowns explicitly recorded.
- Exposure across several vendors that depend on the same underlying provider.
- The decision triggered by deterioration: investigate, restrict, remediate, accept or exit.
- Who approves residual exposure and how the decision expires or is reconsidered.

**Ask for proof:** model a synthetic scenario in which two assessed vendors rely on the same underlying service. Ask which business services are affected and what evidence is missing before management can choose a response.

**Follow-up:** “If the questionnaire is complete but the dependency information is incomplete, what should the dashboard tell the business owner?”

> **Expert quote — pending interview:** [Insert approved quotation and attribution.]