Third-party vendor, every vendor is a third party; not every third party is a vendor

A vendor is someone you buy from. A third party is anyone outside your organisation whose failure lands on you — which includes vendors, and also includes parties with no purchase order: joint venture partners, agents and introducers, franchisees, resellers, and organisations you share data with without paying for the privilege.

The distinction bites at exactly one moment, and it is an expensive one. A register built by exporting the supplier list from finance is complete for spend and incomplete for risk, because the parties it omits are precisely the ones nobody has assessed. Scoping a programme as "vendor risk" and then reporting it as third-party risk coverage is a very common way to be wrong in a board pack.

The numbering confuses people because it is not one convention. In commercial usage the first party is you, the second party is your customer or counterparty, the third party is an external organisation you engage, and the fourth partyis your third party's supplier.

What matters more than the numbering is that risk transmits along the chain regardless of where your contract stops. Your obligations to customers and regulators do not become somebody else's because the failure happened two organisations away — which is the whole reason third-party risk management is a discipline rather than a procurement checkbox.