While adopting to new operating models because of globalization, organizations have relied on third party vendors for specialty services, operational efficiency, cost savings etc. They outsource many revenue and support functions to these vendors. But with this extended business decisions, combined with increased regulatory pressures, organizations need to examine their third-party vendors, service providers and supply chain in order to assess the level of risk, inform decisions and comply with various legislations. Organizations set exposed to reputational risks, operational risks, cyber risks, government investigations and possible prosecution liabilities, failing to adequately assess the third-party vendor risks. To reduce such risks, regulators around the world are working on new laws to make vendor risk management a regulatory requirement.
Some of our service offerings in the Third-Party Assurance vertical are:
- Dealer / distributor reviews
- Customer service centre reviews
- Vendor reviews
- Stock audit / physical verification
Our approach to third-party risk management:
Identifying potential risks – posed by all your third-party relationships
Risk identification is the first step in risk assessment or risk analysis and a critical part of the risk management process. We believe … when we don’t measure something, we can’t manage that thing. Our team identifies the extent and nature of risks i.e. any threat or event that could hinder the client’s strategic objectives. The risk identification process, therefore, begins with understanding client organization’s objectives, interviewing and consulting with relevant stakeholders, not just project managers, for the most comprehensive list of risks.
Few sources of potential risks include:
- External and internal audit reports
- Board meeting/Committee reports
- Financial analysis reports
- Historical data analysis reports
- Key performance indicators (KPIs)
- Market and sector information
Types of identified risks might include:
- Project risk
- Operational risk
- Financial risk
- Legal risk
- Cybersecurity risk
- Reputational risk
Every risk identified as well as its root cause is documented in a risk register for the various stakeholders, be it the management or the project team members. The risk register can be used to decide the type of risk response for each documented risk.
- Classifying vendors – according to their access to your systems, networks, and data
- Reviewing service level agreements (SLAs) – to ensure that vendors perform as expected
- Determining compliance requirements – for your organization including which regulations and standards they and you must meet
- Assessing risk for individual vendors – according to their importance, sensitivity of information each handles and access to your digital network
- Querying vendors – with risk management questionnaires
- Auditing select vendors – according to their answers to the questionnaire, possibly with on-site visits
- Continuously monitoring – for changes in their environment and yours as well as changes in regulations and industry standards.