┌─────────────────────────────────────────────────────────────────────────────┐
│                    THIRD-PARTY ECOSYSTEM IN BANKING                       │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    CORE BANKING                                    │   │
│  │  Core systems, platforms, databases                                │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    TECHNOLOGY VENDORS                               │   │
│  │  Cloud providers, software vendors, hardware vendors               │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    SERVICE PROVIDERS                               │   │
│  │  Payment processors, data providers, credit bureaus                │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    CONSULTANTS                                     │   │
│  │  IT consultants, security consultants, auditors                   │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    PARTNERS                                        │   │
│  │  Fintechs, BaaS providers, payment networks                       │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────────────────────┐
│                    THIRD-PARTY RISK MANAGEMENT LIFECYCLE                  │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    IDENTIFICATION                                   │   │
│  │  Identify third parties, classify, inventory                       │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    RISK ASSESSMENT                                  │   │
│  │  Assess inherent risk, vendor risk rating                          │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    DUE DILIGENCE                                    │   │
│  │  Vendor questionnaires, security assessments, audits                │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    CONTRACTING                                      │   │
│  │  Contracts, SLAs, security requirements                             │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    ONGOING MONITORING                               │   │
│  │  Continuous monitoring, periodic reviews, performance tracking      │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    OFFBOARDING                                      │   │
│  │  Termination, data return, contract closure                        │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘

# ===================================================================
# MODULE 5, LESSON 7: THIRD-PARTY RISK MANAGEMENT
# ===================================================================

import pandas as pd
import numpy as np
import matplotlib.pyplot as plt
import seaborn as sns
from datetime import datetime, timedelta
import warnings
warnings.filterwarnings('ignore')

print("="*70)
print("THIRD-PARTY RISK MANAGEMENT IN BANKING")
print("="*70)

# ----------------------------------------------------------------
# PART A: VENDOR INVENTORY
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART A: Vendor Inventory")
print("-"*60)

# Generate vendor inventory
np.random.seed(42)
n_vendors = 50

vendor_data = pd.DataFrame({
    'vendor_id': range(1, n_vendors + 1),
    'vendor_name': [f'Vendor_{i}' for i in range(1, n_vendors + 1)],
    'category': np.random.choice(['Core Banking', 'Technology', 'Services', 'Payments', 'Cloud', 'Consulting'], n_vendors),
    'criticality': np.random.choice(['Critical', 'High', 'Medium', 'Low'], n_vendors, p=[0.2, 0.3, 0.3, 0.2]),
    'risk_score': np.random.randint(1, 8, n_vendors),
    'last_assessment': [datetime.now() - timedelta(days=np.random.randint(0, 365)) for _ in range(n_vendors)],
    'next_assessment': [datetime.now() + timedelta(days=np.random.randint(30, 180)) for _ in range(n_vendors)],
    'status': np.random.choice(['Active', 'Under Review', 'Approved', 'Terminated'], n_vendors, p=[0.7, 0.1, 0.15, 0.05]),
    'has_breach': np.random.choice([0, 1], n_vendors, p=[0.9, 0.1])
})

print("Vendor Inventory:")
print(vendor_data.head(10).to_string(index=False))

# Visualise
fig, axes = plt.subplots(2, 2, figsize=(14, 10))

# Category Distribution
ax = axes[0, 0]
category_counts = vendor_data['category'].value_counts()
ax.bar(category_counts.index, category_counts.values, color='teal', alpha=0.7)
ax.set_xlabel('Category')
ax.set_ylabel('Count')
ax.set_title('Vendors by Category')
ax.tick_params(axis='x', rotation=45)
ax.grid(True, alpha=0.3)

# Criticality Distribution
ax = axes[0, 1]
criticality_counts = vendor_data['criticality'].value_counts()
colors = {'Critical': 'red', 'High': 'orange', 'Medium': 'yellow', 'Low': 'green'}
ax.bar(criticality_counts.index, criticality_counts.values, 
       color=[colors.get(c, 'gray') for c in criticality_counts.index], alpha=0.7)
ax.set_xlabel('Criticality')
ax.set_ylabel('Count')
ax.set_title('Vendor Criticality')
ax.grid(True, alpha=0.3)

# Risk Score Distribution
ax = axes[1, 0]
risk_scores = vendor_data['risk_score'].value_counts().sort_index()
ax.bar(risk_scores.index, risk_scores.values, color='blue', alpha=0.7)
ax.set_xlabel('Risk Score (1-8)')
ax.set_ylabel('Count')
ax.set_title('Vendor Risk Scores')
ax.grid(True, alpha=0.3)

# Status Distribution
ax = axes[1, 1]
status_counts = vendor_data['status'].value_counts()
ax.pie(status_counts.values, labels=status_counts.index, autopct='%1.1f%%')
ax.set_title('Vendor Status')

plt.tight_layout()
plt.savefig('vendor_inventory.png', dpi=300, bbox_inches='tight')
plt.show()
print("Vendor inventory visualisation saved as 'vendor_inventory.png'")

# ----------------------------------------------------------------
# PART B: VENDOR RISK SCORING
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART B: Vendor Risk Scoring")
print("-"*60)

# Define risk factors and weights
risk_factors = {
    'Security': {'weight': 0.30},
    'Compliance': {'weight': 0.20},
    'Financial': {'weight': 0.15},
    'Operational': {'weight': 0.15},
    'Reputational': {'weight': 0.10},
    'Geopolitical': {'weight': 0.10}
}

# Simulate vendor risk scores
np.random.seed(42)
vendor_risk = pd.DataFrame({
    'vendor_id': range(1, n_vendors + 1),
    'vendor_name': [f'Vendor_{i}' for i in range(1, n_vendors + 1)],
    'security_score': np.random.uniform(1, 8, n_vendors),
    'compliance_score': np.random.uniform(1, 8, n_vendors),
    'financial_score': np.random.uniform(1, 8, n_vendors),
    'operational_score': np.random.uniform(1, 8, n_vendors),
    'reputational_score': np.random.uniform(1, 8, n_vendors),
    'geopolitical_score': np.random.uniform(1, 8, n_vendors)
})

# Calculate overall risk score
weights = {'security_score': 0.30, 'compliance_score': 0.20, 'financial_score': 0.15,
           'operational_score': 0.15, 'reputational_score': 0.10, 'geopolitical_score': 0.10}

vendor_risk['overall_risk'] = (
    vendor_risk['security_score'] * weights['security_score'] +
    vendor_risk['compliance_score'] * weights['compliance_score'] +
    vendor_risk['financial_score'] * weights['financial_score'] +
    vendor_risk['operational_score'] * weights['operational_score'] +
    vendor_risk['reputational_score'] * weights['reputational_score'] +
    vendor_risk['geopolitical_score'] * weights['geopolitical_score']
).round(2)

# Add risk category
def risk_category(score):
    if score <= 2.5: return 'Low'
    elif score <= 4.5: return 'Medium'
    elif score <= 6.5: return 'High'
    else: return 'Critical'

vendor_risk['risk_category'] = vendor_risk['overall_risk'].apply(risk_category)

print("Vendor Risk Scores:")
print(vendor_risk.head(10).to_string(index=False))

# Risk category summary
risk_summary = vendor_risk['risk_category'].value_counts()
print("\nRisk Category Summary:")
print(risk_summary)

# ----------------------------------------------------------------
# PART C: VENDOR DUE DILIGENCE CHECKLIST
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART C: Vendor Due Diligence Checklist")
print("-"*60)

due_diligence = pd.DataFrame({
    'Domain': ['Security', 'Security', 'Security', 'Compliance', 'Compliance', 
               'Financial', 'Financial', 'Operational', 'Operational', 'Reputational'],
    'Check': [
        'SOC2 Type II Report',
        'ISO 27001 Certification',
        'Security Incident Response Plan',
        'GDPR Compliance',
        'PCI DSS Compliance',
        'Financial Statements (3 years)',
        'Insurance Coverage',
        'Service Level Agreements',
        'Disaster Recovery Plan',
        'Reputation Assessment'
    ],
    'Status': ['✅', '✅', '🟡', '✅', '🟡', '🟡', '✅', '✅', '🟡', '🟡'],
    'Priority': ['High', 'High', 'High', 'High', 'High', 'Medium', 'Medium', 'High', 'High', 'Medium']
})

print("Vendor Due Diligence Checklist:")
print(due_diligence.to_string(index=False))

# ----------------------------------------------------------------
# PART D: VENDOR RISK DASHBOARD
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART D: Vendor Risk Dashboard")
print("-"*60)

# Create a vendor risk dashboard
vendor_summary = vendor_data.merge(vendor_risk[['vendor_id', 'overall_risk', 'risk_category']], on='vendor_id')

# Summary statistics
dashboard = {
    'Total Vendors': len(vendor_summary),
    'Critical Vendors': len(vendor_summary[vendor_summary['risk_category'] == 'Critical']),
    'High Risk Vendors': len(vendor_summary[vendor_summary['risk_category'] == 'High']),
    'Vendors with Breaches': vendor_summary['has_breach'].sum(),
    'Average Risk Score': vendor_summary['overall_risk'].mean(),
    'Compliance Rate': len(vendor_summary[vendor_summary['status'] == 'Approved']) / len(vendor_summary) * 100
}

print("Vendor Risk Dashboard:")
for key, value in dashboard.items():
    if isinstance(value, float):
        print(f"  {key}: {value:.2f}")
    else:
        print(f"  {key}: {value}")

# Visualise risk by category
fig, ax = plt.subplots(figsize=(10, 6))
risk_by_category = vendor_summary.groupby('category')['overall_risk'].mean().sort_values()
ax.barh(risk_by_category.index, risk_by_category.values, color='teal', alpha=0.7)
ax.set_xlabel('Average Risk Score')
ax.set_title('Average Risk Score by Vendor Category')
ax.grid(True, alpha=0.3)
plt.tight_layout()
plt.savefig('vendor_risk_by_category.png', dpi=300, bbox_inches='tight')
plt.show()
print("Vendor risk by category visualisation saved as 'vendor_risk_by_category.png'")

# ----------------------------------------------------------------
# PART E: THIRD-PARTY RISK METRICS
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART E: Third-Party Risk Metrics")
print("-"*60)

tprm_metrics = pd.DataFrame({
    'Metric': [
        'Vendor Risk Assessment Coverage',
        'Critical Vendor Risk Score',
        'Vendor Compliance Rate',
        'Third-Party Incidents',
        'Vendor Due Diligence Completion',
        'Contractual Security Compliance',
        'Vendor Performance Score',
        'Vendor Offboarding Rate'
    ],
    'Current Value': [
        '72%',
        '6.2/8',
        '68%',
        '8/year',
        '65%',
        '58%',
        '75/100',
        '5%'
    ],
    'Target Value': [
        '> 95%',
        '< 4/8',
        '> 95%',
        '0/year',
        '> 95%',
        '> 90%',
        '> 85/100',
        '< 10%'
    ],
    'Status': ['🟡', '🟡', '🔴', '🟡', '🔴', '🔴', '🟡', '🟡']
})

print("Third-Party Risk Metrics:")
print(tprm_metrics.to_string(index=False))

# ----------------------------------------------------------------
# PART F: THIRD-PARTY RISK ROADMAP
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART F: Third-Party Risk Roadmap")
print("-"*60)

roadmap = {
    "Phase 1 (0-6 months) – Foundation": {
        "Focus": "Establish TPRM foundation.",
        "Activities": [
            "Create vendor inventory and classification.",
            "Implement vendor risk assessment framework.",
            "Establish vendor due diligence process.",
            "Implement contract security requirements."
        ],
        "Success Metrics": ["Vendor inventory complete", "Risk assessment coverage > 80%"]
    },
    "Phase 2 (6-12 months) – Scale": {
        "Focus": "Scale TPRM capabilities.",
        "Activities": [
            "Implement automated vendor risk monitoring.",
            "Establish vendor performance metrics.",
            "Conduct regular vendor security assessments.",
            "Implement vendor incident response."
        ],
        "Success Metrics": ["Risk assessment coverage > 90%", "Vendor incidents < 5/year"]
    },
    "Phase 3 (12-24 months) – Advanced": {
        "Focus": "Advanced TPRM capabilities.",
        "Activities": [
            "Implement AI-powered vendor risk scoring.",
            "Deploy vendor risk analytics.",
            "Establish vendor risk dashboards.",
            "Build vendor risk culture."
        ],
        "Success Metrics": ["Risk assessment coverage > 95%", "Vendor incidents < 2/year"]
    },
    "Phase 4 (24+ months) – Leadership": {
        "Focus": "Industry-leading TPRM.",
        "Activities": [
            "Implement predictive vendor risk analytics.",
            "Build autonomous vendor risk management.",
            "Achieve industry leadership.",
            "Establish TPRM culture."
        ],
        "Success Metrics": ["Industry-leading TPRM", "Continuous improvement"]
    }
}

for phase, details in roadmap.items():
    print(f"\n{phase}:")
    print(f"  Focus: {details['Focus']}")
    print("  Activities:")
    for activity in details['Activities']:
        print(f"    • {activity}")
    print("  Success Metrics:")
    for metric in details['Success Metrics']:
        print(f"    • {metric}")

# ----------------------------------------------------------------
# PART G: SUMMARY AND RECOMMENDATIONS
# ----------------------------------------------------------------

print("\n" + "="*70)
print("PART G: Summary and Recommendations")
print("="*70)

print("""
Third-Party Risk Management – Key Takeaways:

1. Third-party risk is a major concern for banks (60% of breaches involve third parties).
2. Risk types: cybersecurity, compliance, operational, reputational, financial, concentration.
3. TPRM lifecycle: identification → risk assessment → due diligence → contracting → monitoring → offboarding.
4. Vendor risk scoring: Low, Medium, High, Critical.
5. Regulatory requirements: FFIEC, EBA, NYDFS, GDPR, PCI DSS.
6. Key metrics: risk assessment coverage, critical vendor risk, compliance rate, third-party incidents.
7. Roadmap: foundation → scale → advanced → leadership.

Recommendations:
  - Create a complete vendor inventory.
  - Implement vendor risk assessment framework.
  - Conduct regular due diligence and monitoring.
  - Include security requirements in contracts.
  - Track and report TPRM metrics.
  - Continuously improve vendor risk management.
""")

print("="*70)
print("END OF LESSON 7 – MODULE 5")
print("="*70)