Citi’s Third Party Utility (TPU) performs the initial financial analysis of External Third Parties that are in scope of a financial review. This analysis is performed as an activity under the First Line of Defense.
As part of the Second Line of Defense, TPCRG will review/challenge/provide objection or no objection of the financial analysis prepared by TPU.
The Lines of Defense Roles and Responsibilities presented in this course are in process of being documented across Third Party related policies and standards.
TPCRG completes a Credit Approval (CA) Memorandum to approve credit risk exposure that arises when there’s an agreement for an External Third Party to hold, collect, prepay or settle Citi Funds.
Example: Collection Agency – Citi’s money is in the Third Party’s possession upon collection.
The failure of a Third Party to perform under a TPCR agreement could result in a financial loss and negatively impact Citi’s earnings and capital. It is the responsibility of each business or global function to identify TPCR in their own organization. The Third Party-Risk Assessment Process (TP-RAP) assists in this identification.Global external Third Party relationships
Select the card to flip it.
Globally, Citi has approximately 14,000 external Third Party relationships with over 8,000 Third Party parent companies.
Citigroup spending on Third Party relationships
Select the card to flip it.
Citigroup spent $18.49B on External Third Parties in 2020. $8.8B of this spend was with external third parties within TPCRG’s scope (2020).
Identified and approved by TPCRG
Select the card to flip it.
TPCRG identified and approved 483 External Third Parties with TPCR exposure (as of 12/31/20). The approved Management Action Trigger (MAT) exposure was $9.5B.
Agreements with External Third Parties to either hold, settle, pre-pay or collect Citi’s funds:
Some form of a guarantee given to Citi by an External Third Party or a liability to Citi exists as a result of an agreement:
That’s right.
All of these are examples of TPCR (Third Party Credit Risk).
Not quite.
All of these are examples of TPCR (Third Party Credit Risk).
Not quite.
All of these are examples of TPCR (Third Party Credit Risk).
Not quite. Please try again.
You have missed some options. Review and try again.
By the numbers: Citi’s use of Third Parties
24,500 External Contracts (E-Sourcing)
9,000 Parent Third Parties (Citi-Approved Supplier Program)
14,000 Third Party Relationships (Citi-Approved Supplier Program)
500 Inter-affiliate Services (E-Sourcing/Inter-Affiliate Service Catalog)
8,500 Intra-Citi Service Agreements (E-Sourcing)
That’s right.
All of these are functions of the TPCRG.
Not quite.
All of these are functions of the TPCRG.
Not quite.
All of these are functions of the TPCRG.
Not quite. Please try again.
Consider that TPCRG is a centralized Global Independent Risk function covering Citi-wide in-scope External Third Party relationships.
The Business Activity Owner (BAO) is ultimately accountable for the risk of the Citi activity or business process even if an external third party performs the activity on its behalf.
This includes, but is not limited to, ensuring that the activity is performed in a safe and sound manner and in compliance with applicable laws, regulations and in a manner consistent with Citi policies and standards.
BAO responsibilities include:
A Business Activity Owner (BAO) Support is a role within the Business, or the Resource Management Organization’s Third Party Utility, assigned to Business Activity Owners (BAOs) to assist them with the completion of their third party risk management activities.
The BAO Support is responsible for performing certain activities within the Third Party Relationship Life-cycle on behalf of the BAO.
This is solely a support role and does not reduce the ultimate accountability of the BAO.
Third Party Officers (TPOs) report into the Businesses/Global Functions and are responsible for performing certain activities within the Third Party Relationship Life-Cycle.
TPOs work with the Business, Operations and Technology (O&T) teams, as well as other Citi functions, to:
That’s right.
TPCRG acts as a Second Line of Defense.
Not quite.
TPCRG acts as a Second Line of Defense.
Not quite.
TPCRG acts as a Second Line of Defense.
Not quite. Please try again.
The TPCRG supports Third Party Risk Management, but is not a business owner.
The TPCRG administers the TPCR process for all Citi businesses and sectors.
TPCR exposure arises when there is an agreement with an External Third Party to either hold, settle, prepay or collect Citi funds, where some form of a guarantee or commitment is given to Citi by an external third party, or a liability to Citi exists as a result of an external third party relationship.
The first step of the TPCR process is Identification. In this step, TPCR is identified as in-scope and financial statements are collected for in-scope suppliers.
Select each tab to learn about remaining steps in the Third Party Credit Risk process.
TPCRG may collaborate with stakeholders to quantify TPCR exposure.
Risk Officer prepares Credit Approval Memorandum (CA).
Based on this analysis an approval decision is provided. If Third Party Credit Risk Group objects, the supplier cannot be engaged for this relationship.
CA is approved in the amount known as the TPCR Management Action Trigger (MAT), per Global Commercial Credit Policy Grid 2.1.
The decision is communicated to stakeholders and reflected in the Due Diligence Scorecard as appropriate.
TPCR MAT is reported in Citi Risk Systems.
If TPCRG identifies a potentially elevated level of Operational Risk, partners in Operational Risk Management (ORM) will be engaged to review.
For example:
A supplier managed a rebate program for Cards. The contract called for Citi to pre-fund rebates, and the Business was advancing the monies to the supplier without any controls or provisions to protect the cash (it was just sitting in the supplier’s operating account). ORM helped the Business design a less risky process for disbursing funds.
A holistic review of how potential supplier failure would impact Citi’s ability to deliver services to our customers.
Also called “Headline Risk.” Could a supplier’s failure have negative repercussions for Citi’s reputation?
For example:
Suppliers are chosen as Trustees of Citi pension programs. Although Citi has no legal liability should a trustee misappropriate pension funds, it could damage Citi’s reputation if a Trustee with previous legal issues were engaged.
That’s right.
All of the responses are common elements of TPCRG’s analysis. Other common elements are: Exit Strategy Plan Review and Financial Review.
Not quite.
All of the responses are common elements of TPCRG’s analysis. Other common elements are: Exit Strategy Plan Review and Financial Review.
Not quite.
All of the responses are common elements of TPCRG’s analysis. Other common elements are: Exit Strategy Plan Review and Financial Review.
Not quite. Please try again.
It looks like you missed some common elements. Review the choices and try again.
That's right.
Failing to manage the risks of External Third Party relationships can result in negative outcomes for Citi’s business, operations, and reputation.
Not quite.
Failing to manage the risks of External Third Party relationships can result in negative outcomes for Citi’s business, operations, and reputation.
Not quite.
Failing to manage the risks of External Third Party relationships can result in negative outcomes for Citi’s business, operations, and reputation.
That's right.
The term Risk Accountable is used for any roles and responsibilities that generate risk regardless of which line of defense they reside in.
Not quite.
The term Risk Accountable is used for any roles and responsibilities that generate risk regardless of which line of defense they reside in.
Not quite.
The term Risk Accountable is used for any roles and responsibilities that generate risk regardless of which line of defense they reside in.
That's right.
A supplier misappropriating pension funds is an example of reputation risk. The other situations are examples of Third Party Credit Risk.
Not quite.
A supplier misappropriating pension funds is an example of reputation risk. The other situations are examples of Third Party Credit Risk.
Not quite.
A supplier misappropriating pension funds is an example of reputation risk. The other situations are examples of Third Party Credit Risk.
That's right.
Products/services that require any of these items will trigger Third Party Credit Risk.
Not quite.
Products/services that require any of these items will trigger Third Party Credit Risk.
Not quite.
Products/services that require any of these items will trigger Third Party Credit Risk.
That's right.
Business Activity Owner (BAO) and Third Party Officer (TPO) are roles that perform a risk-generating activity and are therefore designated as risk accountable.
Not quite.
Business Activity Owner (BAO) and Third Party Officer (TPO) are roles that perform a risk-generating activity and are therefore designated as risk accountable.
Not quite.
Business Activity Owner (BAO) and Third Party Officer (TPO) are roles that perform a risk-generating activity and are therefore designated as risk accountable.
That's right.
The Second Line of Defense is comprised of independent risk management units, which include TPCRG, and is responsible for overseeing the risk taking activities of the First Line of Defense and challenging the First Line of Defense in their execution of risk management responsibilities.
Not quite.
The Second Line of Defense is comprised of independent risk management units, which include TPCRG, and is responsible for overseeing the risk taking activities of the First Line of Defense and challenging the First Line of Defense in their execution of risk management responsibilities.
Not quite.
The Second Line of Defense is comprised of independent risk management units, which include TPCRG, and is responsible for overseeing the risk taking activities of the First Line of Defense and challenging the First Line of Defense in their execution of risk management responsibilities.
That's right.
The BAO is responsible for engaging In-Business Risk for guidance on an appropriate action plan to be developed and documented for at risk relationships per TPCRG Financial Capacity Escalation Guidelines.
Not quite.
The BAO is responsible for engaging In-Business Risk for guidance on an appropriate action plan to be developed and documented for at risk relationships per TPCRG Financial Capacity Escalation Guidelines.
Not quite.
The BAO is responsible for engaging In-Business Risk for guidance on an appropriate action plan to be developed and documented for at risk relationships per TPCRG Financial Capacity Escalation Guidelines.
That's right.
TPU performs the initial financial analysis of third parties. TPCRG reviews/challenges/provides objection or no objection of the financial analysis and approves Third Party Credit Risk (TPCR).
Not quite.
TPU performs the initial financial analysis of third parties. TPCRG reviews/challenges/provides objection or no objection of the financial analysis and approves Third Party Credit Risk (TPCR).
Not quite.
TPU performs the initial financial analysis of third parties. TPCRG reviews/challenges/provides objection or no objection of the financial analysis and approves Third Party Credit Risk (TPCR).
That's right.
Prepayment is Citi’s advanced payment for a service that hasn’t been performed, with the prepayment period of six months or longer, and with the amount of at least $1MM USD.
Not quite.
Prepayment is Citi’s advanced payment for a service that hasn’t been performed, with the prepayment period of six months or longer, and with the amount of at least $1MM USD.
Not quite.
Prepayment is Citi’s advanced payment for a service that hasn’t been performed, with the prepayment period of six months or longer, and with the amount of at least $1MM USD.
That's right.
The financial risk rating is one of the factors considered in determining the third party’s Financial Capacity to Perform. Financial Risk Ratings are internal and are not to be shared with third parties.
Not quite.
The financial risk rating is one of the factors considered in determining the third party’s Financial Capacity to Perform. Financial Risk Ratings are internal and are not to be shared with third parties.
Not quite.
The financial risk rating is one of the factors considered in determining the third party’s Financial Capacity to Perform. Financial Risk Ratings are internal and are not to be shared with third parties.
