Citi’s Third Party relationships span North America and all International regions.
To proceed, select each card to learn more about Citi’s Third Party relationships.
Global external Third Party relationships
As of December 2020, Citi had approximately 12,000 external Third Party relationships with over 7,500 Third Party parent companies.
Citigroup’s Spend on Third Party relationships
Citigroup spent $18.49B on External Third Parties in 2020. $8.8B of this spend was with external third parties within TPCRG’s scope (2020).
Approved by TPCRG
TPCRG approved 483 External Third Parties with TPCR exposure (as of 12/31/20). The approved MAT exposure was $9.5B.
Citi uses a large number of External Third Parties to support business operations, client-facing processes and to deliver innovative products and services. Failure to assess and manage the level of risk and complexity of these External Third Party relationships may lead to:
TPM plays an important role in managing and mitigating risks associated with Citi’s use of External Third Parties, enabling enterprise-wide businesses and functions to achieve Citi’s mission of being the best for its clients.
The TPM process is a risk-based approach for managing External Third Party relationships, with dedicated oversight of high-risk relationships. The TP-RAP, discussed later in this course, provides the structure for identifying the inherent risks in a relationship and the required level of due diligence/ongoing monitoring based on the identified risks.
Citi has 22,500 external contracts in eSourcing. There are 7,500 External Parent Third Parties in the Citi-Approved Supplier Program (CASP), and 12,000 External Third Party relationships in CASP.
Any role that performs a risk-generating activity, regardless of which line it resides in and therefore requires risk/control oversight of Independent Risk management, is designated as Risk Accountable.
To proceed, select each tab to learn about three risk accountable roles.
The BAO is ultimately accountable for the risk of the Citi activity or business process even if an external third party performs the activity on its behalf.
This includes, but is not limited to, ensuring that the activity is performed in a safe and sound manner and in compliance with applicable laws, regulations and in a manner consistent with Citi policies and standards.
BAO responsibilities include:
go to next button
BAO Support is a role within the Business, or the Resource Management Organization’s Third Party Utility, assigned to BAOs to assist them with the completion of their third party risk management activities.
BAO Support is responsible for performing certain activities within the Third Party Relationship Life-Cycle on behalf of the BAO.
This is solely a support role and does not reduce the ultimate accountability of the BAO.
go to next button
Third Party Officers (TPOs) report into the Businesses/Global Functions and are responsible for performing certain activities within the Third Party Relationship Life-Cycle.
TPOs work with the Business, Operations and Technology (O&T) teams, as well as other Citi functions to:
go to next button
Each of Citi’s businesses own the risks inherent in or arising from its business. These units are responsible for identifying, assessing, and controlling those risks so that they are within risk appetite. They may also conduct control and support activities.
It is the responsibility of each Citi business or global function to identify TPCR in its own organization as the First Line of Defense.
To proceed, select each tab to learn more about the First Line of Defense in relation to Third Party Credit Risk (TPCR) and Third Party Performance Risk (TPPR).
The First Line of Defense for TPCR is the CLM TPCR team. CLM TPCR is responsible for:
go to next button
The First Line of Defense for TPPR is the Third Party Management Financial Risk Assessment (TPM FRA) team. TPM FRA is responsible for:
go to next button
Internal Audit provides assurance services through the following approaches:
TPCR exposure arises when there is an agreement with an External Third Party to either hold, settle, prepay, or collect Citi funds, where some form of a guarantee or commitment is given to Citi by an external third party, or a liability to Citi exists as a result of an external third party relationship.
Identification of TPCR
TPCR is identified via the BAO’s answer of “Yes” to questions # 9 in Citi’s TP-RAP. TPCRG reviews and challenges the calculation of TPCR exposure.
Approval of TPCR MAT
TPCRG approves TPCR exposure (TPCR MAT) via the CAM. Approval level authority is governed by Wholesale Credit Risk Framework.
Citi uses a large number of External Third Parties to support business operations, client-facing processes and to deliver innovative products and services. Failure to assess and manage the level of risk and complexity of these Third Party relationships may lead to:
Select the best response from the three options and then select Submit.
Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.
That’s right.
Failing to manage the risks of External Third Party relationships can result in negative outcomes for Citi’s business, operations, and reputation.
Not quite.
Refer to Third Party Management Program for more information.
Not quite.
Refer to Third Party Management Program for more information.
That’s right.
Failing to manage the risks of External Third Party relationships can result in negative outcomes for Citi’s business, operations, and reputation.
Not quite.
Refer to Third Party Management Program for more information.
Not quite.
Refer to Third Party Management Program for more information.
In the Lines of Defense Construct, which level is used to describe any role and responsibility that generates risk?
Select the best response from the four options and then select Submit.
Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.
That’s right.
The term Risk Accountable is used for any roles and responsibilities that generate risk regardless in which line of defense they reside.
Not quite.
Refer to Stakeholder Roles and Responsibilities for more information.
Not quite.
Refer to Stakeholder Roles and Responsibilities for more information.
That’s right.
The term Risk Accountable is used for any roles and responsibilities that generate risk regardless in which line of defense they reside.
Not quite.
Refer to Stakeholder Roles and Responsibilities for more information.
Not quite.
Refer to Stakeholder Roles and Responsibilities for more information.
Third Party Credit Risk arises in which of these situations?
Select the best response from the four options and then select Submit.
Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.
That’s right.
A payment to a supplier results in TPCR when funds of at least $1,000,000 are paid more than 6 months in advance.
Not quite.
Refer to Third Party Credit Risk Group for more information.
Not quite.
Refer to Third Party Credit Risk Group for more information.
That’s right.
A payment to a supplier results in TPCR when funds of at least $1,000,000 are paid more than 6 months in advance.
Not quite.
Refer to Third Party Credit Risk Group for more information.
Not quite.
Refer to Third Party Credit Risk Group for more information.
In the Third Party Risk Assessment Process (TP-RAP), which of these requirements for products/services will trigger TPCR?
Select the best response from the three options and then select Submit.
Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.
That’s right.
A payment to a third party triggers TPCR when funds of at least $1,000,000 will be paid more than 6 months in advance. A third party holding funds of $1,000,000 or more also qualifies as TPCR.
Not quite.
Refer to Third Party Management Program for more information.
Not quite.
Refer to Third Party Management Program for more information.
That’s right.
A payment to a third party triggers TPCR when funds of at least $1,000,000 will be paid more than 6 months in advance. A third party holding funds of $1,000,000 or more also qualifies as TPCR.
Not quite.
Refer to Third Party Management Program for more information.
Not quite.
Refer to Third Party Management Program for more information.
Which of these roles are designated as risk accountable in the Third Party Management process?
Select the best response from the four options and then select Submit.
Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.
That’s right.
Business Activity Owner (BAO) and Third Party Officer (TPO) are roles that perform a risk-generating activity and are therefore designated as risk accountable.
Not quite.
Refer to Stakeholder Roles and Responsibilities for more information.
Not quite.
Refer to Stakeholder Roles and Responsibilities for more information.
That’s right.
Business Activity Owner (BAO) and Third Party Officer (TPO) are roles that perform a risk-generating activity and are therefore designated as risk accountable.
Not quite.
Refer to Stakeholder Roles and Responsibilities for more information.
Not quite.
Refer to Stakeholder Roles and Responsibilities for more information.
TPCRG’s activities include which of the following?
Select the best response from the four options and then select Submit.
Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.
That's right.
TPCRG reviews and challenges the financial analysis performed by the Second Line of Defense (TPM FRA or CLM TPCR).
Not quite.
Refer to Stakeholder Roles and Responsibilities for more information.
Not quite.
Refer to Stakeholder Roles and Responsibilities for more information.
That's right.
TPCRG reviews and challenges the financial analysis performed by the Second Line of Defense (TPM FRA or CLM TPCR).
Not quite.
Refer to Stakeholder Roles and Responsibilities for more information.
Not quite.
Refer to Stakeholder Roles and Responsibilities for more information.
In the Third Party selection due diligence and ongoing monitoring processes, which unit is responsible for completing the initial financial analysis of Third Parties?
Select the best response from the four options and then select Submit.
Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.
That's correct.
TPM FRA or CLM TPCRG performs the initial financial analysis of third parties.
Not quite.
Refer to Stakeholder Roles and Responsibilities for more information.
Not quite.
Refer to Stakeholder Roles and Responsibilities for more information.
That's correct.
TPM FRA or CLM TPCRG performs the initial financial analysis of third parties.
Not quite.
Refer to Stakeholder Roles and Responsibilities for more information.
Not quite.
Refer to Stakeholder Roles and Responsibilities for more information.
There are several categories of Third Party Credit Risk within Citi. Examples of which TPCR category include advancement of funds for software licensing, system maintenance or employee healthcare services?
Select the best response and then select Submit.
Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.
That’s right.
Prepayment is Citi’s advance of at least $1MM for a period greater than 6 months for a service that hasn’t been performed yet.
Not quite.
Refer to Third Party Credit Risk Group for more information.
Not quite.
Refer to Third Party Credit Risk Group for more information.
That’s right.
Prepayment is Citi’s advance of at least $1MM for a period greater than 6 months for a service that hasn’t been performed yet.
Not quite.
Refer to Third Party Credit Risk Group for more information.
Not quite.
Refer to Third Party Credit Risk Group for more information.
As part of Second Line of Defense, TPCRG is responsible for:
Select the best response from the four options and then select Submit.
Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.
That’s right.
The Second Line of Defense is comprised of independent risk management units, which include TPCRG, and is responsible for overseeing the risk-taking activities of the First Line of Defense and challenging the First Line of Defense in their execution of risk management responsibilities.
Not quite.
Refer to Stakeholder Roles and Responsibilities for more information.
Not quite.
Refer to Stakeholder Roles and Responsibilities for more information.
That’s right.
The Second Line of Defense is comprised of independent risk management units, which include TPCRG, and is responsible for overseeing the risk-taking activities of the First Line of Defense and challenging the First Line of Defense in their execution of risk management responsibilities.
Not quite.
Refer to Stakeholder Roles and Responsibilities for more information.
Not quite.
Refer to Stakeholder Roles and Responsibilities for more information.
Which of the following questions on the Third Party Risk Assessment Process (TP-RAP) is asked to detect the presence of Third Party Credit Risk (TPCR)?
Select the best response from the four options and then select Submit.
Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.
That’s right.
An affirmative answer to Question 9 of the TP-RAP (“Will these products/services require Citi to have a contractual obligation to make prepayments of ≥ $1,000,000 and for periods greater than 6 months?”) indicates the presence of TPCR.
Not quite.
Refer to Third Party Management Program for more information.
Not quite.
Refer to Third Party Management Program for more information.
That’s right.
An affirmative answer to Question 9 of the TP-RAP (“Will these products/services require Citi to have a contractual obligation to make prepayments of ≥ $1,000,000 and for periods greater than 6 months?”) indicates the presence of TPCR.
Not quite.
Refer to Third Party Management Program for more information.
Not quite.
Refer to Third Party Management Program for more information.
go to close menu button
go to close button
