Why organizations need to adopt an Integrated Third-Party Governance and Risk Management approach?

Log in to the SIG Community
Linkedin Twitter Youtube Facebook

Image of Third-Party Risk Management

SIG University  Certified  Third-Party Risk Management Professional  (C3PRMP) program graduate Jai Chinnakonda shares why every organization should adopt integrated third-party risk governance and management into their team structure.

Organizations increasingly depend on third-party service providers of varying sizes, including start-ups, to meet the digital age challenges of technological innovation and heightened competition. In a quest to succeed, organizations involved in digital transformation initiatives partner with more innovative start-ups, thereby increasing third-party risk. There is a progressive shift from a traditional ‘cost’ focus to a ‘shared risk’ and ‘value-driven partnership.

This is also a growing reflection of organizational recognition that third parties can create strategic win-win opportunities.  These new-age partnerships require a different approach to managing third-party risks. Organizations that can continuously monitor and take on calculated risks with their engagement with third parties are the ones that will be able to Stay Ahead. This article reflects on how technology can help support a new Integrated third-party governance and risk management approach.

Traditional  Third-Party Risk Management Approach – the challenges  

Traditionally, organizations had relied on total upfront due diligence for risk mitigation. This approach attempts to identify potential third-party risks upfront before contracting, resulting in longer onboarding time. Typically, this involves sharing due-diligence questionnaires and collating responses from third parties. This only provides a point-in-time assessment – a highly ineffective approach prone to failures.

A survey conducted by Gartner suggests that this approach is largely ineffective as it fails to capture any risk that may arise during the relationship. Among organizations that engage third parties to provide business services, 83% identified third-party risks after conducting due diligence and before recertification, according to Gartner.

So, where does the problem lie? The race to attain digital supremacy within their industry segment has forced many organizations to look at new-age start-ups and innovators whose business environments are changing almost daily. This requires closely engaging with third parties and adopting an ongoing risk identification, control, and monitoring mechanism.

A continuous iterative risk assessment means more investment and resource requirements in many organizations. This also strains your relationship with third parties as they must spend time responding to due-diligence questionnaires. How can organizations make this process efficient, effective, and, most importantly, palatable to third parties?    

An  Integrated  Third-Party Governance and Risk Management approach – a new shift    

Given the dynamic nature of the business ecosystem, a robust third-party risk management solution should provide near real-time visibility into your third-party ecosystem and enable collaboration and relationship building. It’s time to apply an  Integrated  Third-Party Governance, Relationship, and Risk Management approach to efficiently and effectively manage third parties.  Risk management is not just about completing assessment questionnaires and doing site visits.

It is also about how much you understand your organization’s business needs, the critical services being outsourced, the impact on your customers in case of disruption to those outsourced services, and how well you manage relationships with your third parties. An organization cannot fully succeed in managing and mitigating its third-party risk without having a robust governance and relationship framework.    

In today’s digital age, no organization can thrive on its own. To drive value from your vendor partner and help meet business objectives, your organization must build a lasting relationship with vendor partners. With organizations strengthening their perimeter, hackers have found it easier to breach third parties. While there is no fool-proof method to eliminate all risks, technology can help make the third-party risk management process more effective and efficient.

A report from Deloitte titled ‘Third-party governance and risk management. The threats are real’ confirms that ‘Existing technology platforms for managing third parties are considered inadequate. According to the report, increased monitoring and assurance activity over third parties is believed to reduce third-party risk significantly.  

This increased monitoring and assurance activity is only possible through a technology platform that should, at minimum, focus on the following key components:  

1.  Third-Party Governance & Relationship Management  – As dependence on third parties becomes increasingly critical, organizations are compelled to play catch up in enhancing their governance processes. Periodic reviews are essential to the prudent governance process and are seen as a two-way relationship-building process.  Setting-up regular cadence, business review meetings, centrally tracking issues, and triggering timely alerts for reviews, missing critical documents, contract non-compliance, and SLA misses are all use cases.  

2.  Risk Management – Leveraging Intelligent Automation    

Ability to auto-trigger risk assessments based on specific triggers (internal or external events concerning the third party), centrally manage all reviews with the ability smartly sense issues based on the third-party response.  

Preliminary Assessment

Ability to determine the Criticality and Inherent Risk based on preliminary assessment based on customizable risk dimensions and the ability to auto-trigger re-assessment due to internal or external changes. Some key risk dimensions that must be covered:  

Detailed Assessment based on Criticality and Risk – Information Gathering  

Controls Assessment  

3.  Integrated AI-Driven Alerts & Continuous Monitoring   – Ability to continuously monitor to receive intelligent alerts and trigger actions.  

Organizations can integrate the following to monitor third parties on a near real-time basis.

4. Service Excellence & Innovation   – Ability to define, track and measure KPIs and KRIs, including measuring the strategic value your third party brings.  

5.  Predictive Analytics   –  Ability to sense leading and lagging indicators and take proactive actions. More and more organizations are taking a closer look at current technology platforms. Automation has been there for a while, but AI-Driven digital and cognitive enablement is evolving and is likely to redefine other engagement experiences involving third parties. The challenge, though, has been with integrations with in-house upstream and downstream systems.        

Deloitte report mentions that Third-Party risk is starting to feature consistently onboard agendas with CEO/board-level responsibility in the more progressive organizations or those operating in highly regulated environments. This also means more and more organizations have begun investing in the right technology solutions to enable continuous risk monitoring. The industry as a whole, however, is still playing catch-up in enhancing the maturity of its third-party governance and risk management processes.

In the end, Third-Party Governance and Risk Management are all about the art and science of engaging your organization’s third parties. While emerging technologies such as AI and Machine Learning can sure assist in the ‘science’ of engagement, the ‘art’ of engagement will largely depend on human intuition.  

SIG University’s  Certified  Third-Party Risk Management Professional  (C3PRMP) program is a globally recognized certification that is the €œgold standard € in terms of relevance, scope and content. The C3PRMP  program was created by Linda Tuck Chapman, an advisor, educator, author and expert.

Learn more