third party risk management

third party risk management

The Importance of Third-Party Risk Management in Modern Business Operations

1. Introduction to Third-Party Risk Management

There are, however, many instances of failure for service organizations to speak to their clients and investors without exception when the quality of their work is poor or strays from report promises. Additionally, governance must respect regulations and laws, have competent oversight with a willingness to deal with the service organization in order to determine that the business enterprise’s service requirements are met. This places a greater responsibility on the shoulders of the governing board when there is an increasing dependence on third parties for business-critical functions. The OSG sets standards of assurance on risk management with formalized rules, while other compliance and control frameworks support best practice including COSO’s Internal Control-Integrated Framework, COBIT’s IT Governance Framework, ITIL’s best practices, and the UK’s Turnbull Guidance.

There is often the assumption that pointing the finger at a third-party service provider is equivalent to pointing the finger at a scapegoat because they often perform their work in remote locations or cross various state or national borders. The truth is that it is not unusual to find that the legal liabilities step up when a third-party organization provides a substandard service to a business, and there is a failure to exercise some independent judgment when assessing the accuracy and reliability of the information received. There is an ever-increasing degree of regulation associated with governing the use of third-party service providers, maintained by every business in retail, commercial, public sector, financial industry, technology, and life sciences and each of those applications falls within the smaller space of “service organization reporting”. Of course, such incidences nearly eliminate when organizations subject themselves to international standard or regulatory compliance, high ethical practice and governance, and lead by example.

Third-party risk management is a term representing the process of looking at the risks related to dealing with third-party service organizations or businesses. The requirement to manage third-party risk is felt due to the inherent fact that virtually every business exists as part of an ever-complex supply chain and utilizes many business providers. This includes such providers as payroll processors, technology service, market analysts, and even the auditor when the matter of the audit firm being considered a third party. One of the greatest areas of concern is entrusted with sensitive information or intellectual capital with third-party asset managers, like pension plan managers, VC post-investment managers or other approved investment or fund managers. Although third-party service entities are an efficient way to operate and cut costs, their use does not in any way circumvent the need for internal control—a need which is multiplied when the business involves the trust of clients and investors.

2. Key Concepts and Definitions in Third-Party Risk Management

Third-party risk management is a subset or discrete component of integrated risk management, recently defined by the Association of Information Systems (AIS) as the continuous, proactive process that is supported by business-enabling technology to aggregate information, assess potential impact, and analyze how to manage critical business risk in a timely manner. According to PricewaterhouseCoopers, third-party risk management is the process companies use to manage risks associated with outsourcing key services, enabling them to identify, assess, and mitigate weaknesses in supplier controls. The idea underlying the management of risk derived from third parties is that an organization is not an island but its operations are interconnected with other service providers. These other service providers are also termed as vendors, contractors, consultants, suppliers, and outsourcers, interchangeably. They play an independent role in performing a business process on behalf of the primary enterprise.

The modern business operations environment is so complex, even small businesses can be exposed to third-party risks. And even so, third-party relationships are increasingly becoming a key determinant in the ability of organizations to deliver business value, to adapt to changing business conditions, to satisfy customer needs, and to ensure a competitive edge over other industry turnovers. For businesses, especially those involved in global supply chains, they would have a sound third-party risk management to identify and manage the resultant risks. Otherwise, they might have their own reputations as best place to work, to grow, and to grow business eroded easily due to the considerable damage caused by exposure to the risk of third parties. This chapter presents an overview of the concepts.

3. Best Practices and Strategies for Effective Third-Party Risk Management

Trying to manage them all properly with a working manual, monitoring each of them through structured talks, or forcing them to honor compliance and regulation requirements with contracts too easily causes a burden on the already stretched subject matter experts who administer these deals. These challenges often lead to not fully assessing and mitigating the related third-party risks as necessary, and this can turn out to be unaffordable and catastrophic to your organization in the end.

All these risks associated with third-party relationships have served as a wake-up call for corporate leaders to increase their focus on taking better control of all the ways in which these third parties can either intentionally or unintentionally harm your company. Many external and internal drivers exist to spotlight the importance of third-party risk management (TPRM) and cause your firm to take proactive steps to manage it more effectively. There are the various privacy compliance mandates, the necessary audit functions that monitoring firms or regulators require of your organization, the multiple opportunities available to these third-party entities who are eager to exploit their role and alter the desired security landscape, and the potential barriers these relationships create against your company’s rapidly changing economy.

And so, while these third-party entities can be very beneficial to a company, they also bring a significant amount of risk, both to your organization and to the customer data that you are responsible for safeguarding. With the adoption of various privacy legislations such as GDPR, CCPA, LGPD, POPIA, PDPA, and others, a company often becomes fully or partially liable if a vendor proves to be non-compliant or if they experience a data breach and personal information is accessed on the company’s stored data. These third parties’ data protection mishaps can lead to lost revenue through fines or penalties, lawsuits, exorbitant costs to mitigate the damages, or harm to your firm’s reputation, eroding the trust of your customers and partners.

No matter what industry sector your firm operates within, the chances are that it engages numerous third-party entities as part of an extensive and increasingly global network of suppliers, vendors, distributors, resellers, software maintenance providers, contingent labor agencies, or countless others. And these third parties may contain or gain access to vast amounts of sensitive business or customer data as part of their relationship with you.

4. Challenges and Solutions in Implementing Third-Party Risk Management

There are potential solutions. Companies can use information technology to coordinate and automate TPRM processes, minimizing business disruption. Companies can find ways to directly make use out of due diligence and risk assessment results, monetizing the cost of performing TPRM activities. It is necessary to balance independent third-party audit and certification with a business responsibility to continuously address security and control problems. Cyber liability insurance may be a cost-effective tool to reallocate TPRM risks alongside third-party contracts. Finally, business leaders will take positive action when the value discipline nooses have a firm grip on the business operation.

There are several challenges in implementing TPRM. It can be a costly endeavor. TPRM processes can temporarily disrupt aspects of a company’s third-party engagement without achieving a corresponding reduction of risk, creating a value gap between the functions performed and the results occurring from those functions. A company implementing TPRM usually has other compliance demands and internal disruptions occurring at the same time. TPRM can be a secondary consideration for the company engaged in M&A or substantial business divestitures. Not following TPRM discipline can result in business disruption. Business leaders may feel either that they have no choice but to take undue compliance risk or feel business pressure to achieve short-term goals far beyond other compliance objectives.

5. Case Studies and Real-World Examples of Successful Third-Party Risk Management

In light of the various threats and concerns faced by both public and private organizations, third-party risk management is more critical than ever but remains overlooked territory. It’s difficult for non-security functions to grasp how something like customer data misuse by a third-party vendor could have massive privacy impacts and privacy law penalties on an organization, particularly when the relationship is through a third-party vendor. As we’ll see in this chapter, a whole risk management program line is in order because simply throwing in a few IT audit checklist items seriously falls far short of the mark. Detailed examination and documented evidence of activity, risk, and control creates a responsibility chain (audit checklist) that can have a huge impact on organizational values, vision, and strategy. Leadership plays a role in the development of policy, identification of risk exposure, implementation, and the monitoring of activity for results that are not tolerated due to a culture of ever-greater accountability.

Understanding a theoretical concept and its importance is one aspect of the audience’s technical expertise. It’s difficult, however, for many organization leaders to fully realize the need for enhanced third-party risk management without concrete real-world examples. In this section, we present individual case study examples of companies that faced public scrutiny and backlash (or praise for being proactive) for their third-party risks with detailed information surrounding the incidents and outcomes. For example, Wells Fargo, the third-party partner, and the reseller’s risk management relationship was a part of the course case study. Events and consequences related to the sales practices scandal, however, were critical and in no way affected the risk exposure relationship between the two parties. Students could come to the conclusion that managing third-party risk and seeing it broadly applicable to B2B sales (why would Wells Fargo advertise anything that internally was wrong?) as part of the discussion for this case study.