Due Diligence and Ongoing Monitoring

When conducting Financial Health and Reputational Backgrounding checks on your third parties how far back do you consider relevant? Is there an industry standard like a credit report of 7 years or is it based on severity i/e if there was something minor 8 years ago it's out of scope but if it's major then it's still considered? 

Hi there,

Typically, when reviewing a financial health of a third-party two to three years worth of data is most likely sufficient (with five years being a maximum number) to typically review to get a trended view of performance and a thorough analysis of the financial metrics and ratios.

If you personally would like to do more, you certainly can, but it is not recommended, nor required given that financial health is a dynamically changing item and new information both at the third-party level and macro-wise is much different from year to year (let alone over a longer period of time, like 3, 5, or 7 years).

Also a reminder - the more information you use, the more time-consuming each individual review may be. If you have sufficient time to dedicate for more thorough diligence that meets your risk appetite, you can perform that. But often times, professionals doing these reviews also need to manage time with more volume among competing priorities. 

In the case of background checks, that is also dependent on your risk appetite and desire to go as far back as possible. Notionally, something within a 7-10 year time window (like you suggest in your original post) covers off enough time to get a full view of history on a third-party. From there, you can note the findings and when they occurred, as well as what the severity is and compare it to your internal risk appetite posture. 

Hope this is helpful!