Third Party Risk Management 

Let’s start with the obvious...

 

It’s all about the risk. A properly constructed and well-run vendor risk management program will, first and foremost, reduce risk. Third parties, particularly those that handle sensitive data, have the potential of exposing your organization to the risk of a breach, non-compliance, financial penalties, and reputational damage. If your VRM program is humming along, you’ve likely brought those risks down to a level that, at a minimum, matches your risk appetite. 

​

With third-party risk appropriately mitigated, you can take a deep breath and focus on driving the most value from your vendor relationship.

​

Cutting costs, not corners. Ad hoc vendor risk management programs are costly and ineffective. Operating without a vendor risk management program can be even more so, especially when you factor in the costs associated with data loss, remediation work, and compliance fines. 

While building a vendor risk management program from the ground up requires an upfront investment, the long-term effects are priceless. The cost of working with vendors is ultimately reduced, as a centralized and standardized process for scoring vendors during initial onboarding eliminates the need for duplicative and costly assessments every time the vendor engages with a new area of your business.  Do it right the first time, and your long-term costs are merely the costs of ongoing monitoring of vendors. Centralizing and standardizing your vendor risk management also reduces the operational costs of evaluating vendors. If IT, Compliance, Procurement, and Risk Management are all performing discrete risk assessments of new vendors, you’re likely seeing operational inefficiencies that are driving up the cost of assessing each vendor (and giving your vendors headaches). Centralizing these activities in a single VRM function can dramatically reduce your labor and cost.

​

Understanding risk over time. A well-designed vendor risk management program creates better metrics for comparing risk scores between competing vendors, giving you simple, repeatable, reliable metrics for evaluating the risk levels of your vendors. This is useful, of course, during initial vendor selection, but it can also be used during contract recompetes and renewals. Knowing a vendor’s risk score (ideally kept up-to-date through ongoing monitoring) allows you to award contracts to “low hassle” vendors – those with a proven track record of strong internal controls and data protection mechanisms – reducing the total cost you’ll spend on vendor maintenance, monitoring, and mitigation over the lifetime of the contract.

​

Gaining leverage. Engaging third parties requires negotiation, and there is tight competition for your business. Knowing the risk profile of a vendor gives you leverage to require that the prospective vendor change their behaviours in certain ways. In some cases, it may also give you a tool to negotiate pricing, as you seek to reduce the cost of the vendor to allocate funds toward risk mitigation.  Both of these outcomes enable improved vendor behaviours and cost reductions, resulting in positive impacts on your business and vendor relationship. 

​

Maintaining compliance. Most new industry frameworks and data privacy regulations have recognized the reality that a company’s vendor ecosystem serves as an extension of the company and should be treated as such.

The EU’s General Data Protection Regulation (GDPR) is the first regulation to hold data processors – in many cases, vendors – equally responsible in the event of a breach. It also places increased emphasis on the data controller (which is often you) to have adequate controls in place to protect data that is being processed outside your perimeter. The post-GDPR wave of regulations, like the California Consumer Privacy Act, seems likely to continue this trend, requiring that you pay more and more attention to your vendors, or face skyrocketing fines in the event of a breach. A strong VRM program simplifies your compliance initiatives and protects you from fines and penalties.

​

Building consistency and continuity. Centralized vendor risk management means that vendor risk is understood by your organization, not just the individual managing the vendor relationship. If you have departmental leadership changes, new leaders will be able to review and understand the risk of each vendor, as well as their historical risk performance, without interruption.

​

Additionally,  TRM allows everyone in the organization to quickly engage approved vendors for high-priority projects, without having to deal with unnecessary inter-department bureaucracy. Expand this idea out to complex organizations with portfolio companies or sub-brands, and you can begin to realize massive efficiencies. The consistency and centralized nature of the assessments means that your business can operate swiftly and without interruption, even as internal resources change.