Managing third-party risk has taken on the need for longevity. Aside from addressing risk management needs and regulatory requirements, institutions should develop a risk-based program which also incorporates a complimentary suite of preventative and detective controls across the three lines of defense.