That's a great question. OFCCP answers it on page 11 of its Supply & Service Technical Assistance Guide. The contractor remains responsible for the recordkeeping obligation. It can be done by the third-party provider on behalf of the contractor but the contractor will ultimately be responsible if the records are not kept by the provider in a readable and accessible form for OFCCP. Here is a link to the guide: https://www.dol.gov/sites/dolgov/files/OFCCP/SupplyService/files/508_sstag_12032020.pdf
You can use this OFCCP audit checklist to ensure you're doing what is required to maintain OFCCP's regulations including VEVRAA, Section 503, and EO 11246. Or request a demo to streamline your compliance and recruiting efforts.