The application of third-party risk management policies and processes to an organization’s third parties’ subcontractors and their other third parties. Regulators often require financial services firms to understand who their critical fourth parties are, and the level of risk they pose individually. Regulators also wish firms to know the risk that these fourth parties could pose collectively, which is a form of concentration risk.