Which is the first stage in the OCC lifecycle framework for third party risk?

• A. Planning
• B. Due Diligence and Third Party Selection
• C. Contract Negotiation
• D. Ongoing Monitoring

Answer: (A)

Planning sets the foundation for every third-party engagement. It involves defining governance, objectives, risk appetite, and the scope of the program, as well as identifying critical vendors and the data and systems they access. Without this planning, you wouldn’t have a clear framework for evaluating vendors, determining risk levels, or applying controls. The subsequent stages—due diligence and selection, contract negotiation, and ongoing monitoring—rely on the plan to guide evaluation criteria, contractual requirements, and ongoing oversight. Therefore, Planning is the first stage.