Scribd Logo
Upload

Welcome to Scribd!

  • 61 views

    2019 Third Party Risk

    Uploaded by

    Kumar Aditya
    This document discusses the need for organizations to shift from a point-in-time approach to managing third-party risk to an iterative approach. It notes that third parties now require greater access to organizations' data and work with their own third parties, increasing complexity and risk. The current approach focuses too much on initial due diligence rather than ongoing monitoring. The document recommends that organizations streamline due diligence, establish internal triggers to monitor for changes, and create controls and incentives for ongoing monitoring in order to improve risk management outcomes.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    2019 Third Party Risk

    Uploaded by

    Kumar Aditya
    61 views16 pages
    This document discusses the need for organizations to shift from a point-in-time approach to managing third-party risk to an iterative approach. It notes that third parties now require greater access to organizations' data and work with their own third parties, increasing complexity and risk. The current approach focuses too much on initial due diligence rather than ongoing monitoring. The document recommends that organizations streamline due diligence, establish internal triggers to monitor for changes, and create controls and incentives for ongoing monitoring in order to improve risk management outcomes.

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses the need for organizations to shift from a point-in-time approach to managing third-party risk to an iterative approach. It notes that third parties now require greater access to organizations' data and work with their own third parties, increasing complexity and risk. The current approach focuses too much on initial due diligence rather than ongoing monitoring. The document recommends that organizations streamline due diligence, establish internal triggers to monitor for changes, and create controls and incentives for ongoing monitoring in order to improve risk management outcomes.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    61 views16 pages

    2019 Third Party Risk

    Uploaded by

    Kumar Aditya
    This document discusses the need for organizations to shift from a point-in-time approach to managing third-party risk to an iterative approach. It notes that third parties now require greater access to organizations' data and work with their own third parties, increasing complexity and risk. The current approach focuses too much on initial due diligence rather than ongoing monitoring. The document recommends that organizations streamline due diligence, establish internal triggers to monitor for changes, and create controls and incentives for ongoing monitoring in order to improve risk management outcomes.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 16

    Click here or press enter for the accessibility optimised version

    Stay
    Ahead of
    Growing
    Third-
    Party Risk
    Edited by Chris Audet
    Director, Gartner
    Click here or press enter for the accessibility optimised version

    Introduction
    “There's no question that third parties are redefining how our business competes
    in the new digital world,” said one chief compliance officer at a financial services
    organization.

    Today's third parties require more access to the organization's data assets and are
    increasingly working with their own third parties, multiplying the size and
    complexity of the third-party network. In fact, in the last four years, legal and
    compliance leaders have classified 2.5X more third parties as high-risk.

    Managing the risks associated with these networks while not hindering business
    speed is a critical challenge for leaders.
    Managing Third-Party Risk

    A Cross-Functional Concern

    Compliance and legal are the


    primary owners of third-party
    risk management but many
    other functions have a stake in
    improving risk management
    and business outcomes.
    Third-Party Risks Are
    Changing
    This year, twice as many compliance leaders identify third-party risk as
    a top threat. This is because third-party risks have fundamentally
    changed. Leaders say they have experienced:

    Greater variability in the maturity of their third-party network


    Third parties working with an increasing number of third parties
    themselves
    Increased third-party access to organizational data assets

    "Consider the new ways your own business is


    using third parties. Increasingly, they're
    performing new-in-kind technology or analytics
    services, providing services outside of the
    company's core business model, and are Not only that, the role third parties play in business is also changing.
    increasingly comprised of startups and other
    business model innovators. These changes Leaders find themselves in the middle of what feels like an unwinnable
    demand a fundamentally different approach to risk war: one that demands risk oversight while maintaining speed.
    identification and monitoring."
    Chris Audet, Director, Gartner Research & Advisory
    Click here or press enter for the accessibility optimised version

    The Current
    Approach Is
    Point-in-Time-
    Focused
    Traditionally, 73% of effort
    devoted to risk identification is
    allocated to due diligence and
    recertification efforts, with only
    27% of effort allocated to
    identifying risks over the course
    of the relationship.
    Why Point-in-Time?
    Mandates from regulators
    and enforcement bodies
    Expectations from
    consumers and an activist
    media
    Cost implications
    The point-in-time
    approach often fails
    because it misses
    changes in third-
    party relationships
    The current monitoring
    approach cannot account for
    changes that are inevitable in
    conducting business today —
    those associated with strategy,
    personnel, risk appetite or
    scope of relationship.
    Click here or press enter for the accessibility optimised version

    Make the Shift


    to an Iterative
    Approach
    Gartner research found that to
    improve the identification and
    monitoring of third-party risk,
    legal and compliance leaders
    should take an iterative
    approach. This approach
    requires some information to be
    learned prior to contracting with
    the third party, but places
    greater emphasis on continued
    learning over the course of the
    third-party relationship.
    Streamline Due Diligence to
    Focus on Critical Risks
    Use a data-driven methodology to determine
    risks that have impacted the organization in
    the past and source feedback from the
    business to identify future risks.

    Case Study: Data-Driven Due Diligence


    Questionnaire

    Facing an ever-expanding due diligence


    questionnaire and lengthy due diligence
    process, a healthcare organization sought to
    reduce its time and effort on due diligence.
    This data-driven understanding focuses on
    risks that have previously impacted the
    company or may impact it in the future. The
    compliance team assessed which due
    diligence questions have been the most
    effective indicators of risk based upon
    previous third-party incidents, industry data,
    and relevant hotline data (among other
    sources).
    Establish Internal Triggers to
    Monitor for Change
    Monitor your third-party network with
    triggers throughout the business to signal
    changes in the third-party relationship.

    Case Study: Trigger-Based Monitoring

    A financial services organization wanted a


    more comprehensive means of reviewing
    operations across the business to identify
    activity that could expose the company to
    risk. The organization built automated trigger
    reports to identify emerging risks based on
    an understanding of cross-functional
    business metrics. When observed metrics are
    exceeded, a report is triggered for
    compliance review, alerting compliance to an
    emerging risk in real-time.
    Create Controls and Incentives
    to Monitor for Change
    Embed controls and incentives to manage
    high-risk third parties and improve ongoing
    monitoring.

    Case Study: Collaborative Risk


    Management

    An organization providing
    telecommunications services faced two
    distinct challenges. First, suppliers had an
    uneven level of understanding of how to
    tackle reputation risks posed by their
    suppliers. Second, it was difficult to assess
    the capability of data collected during
    traditional ethical and environmental risk
    audits.
    Three Key Shifts for Legal and Compliance Leaders

    1. Streamline due diligence 2. Establish internal triggers 3. Create controls and


    to focus on critical risks to monitor for change incentives to monitor for
    change
    Identify opportunities to reduce Monitor your third-party network with Embed controls and incentives to manage
    exhaustive due diligence and streamline triggers throughout the business to signal high-risk third parties and improve
    processes with a focus on critical risks. changes in the third-party relationship. ongoing monitoring.
    Click here or press enter for the accessibility optimised version

    An Iterative
    Approach
    Improves
    Outcomes
    An interative approach has a
    positive impact on desired risk
    management and business
    outcomes.
    Improved
    Outcomes
    Through this approach, leaders will see
    improved outcomes, including the:

    Ability to surface third-party risks before it’s


    too late to remediate
    Ability to quickly remediate third-party risks
    before they have any material impact
    Satisfaction of business partners when it
    comes to the speed of due diligence,
    onboarding and engaging with third
    parties
    Click here or press enter for the accessibility optimised version

    Learn more.
    Dig deep.
    Stay ahead.
    Gartner for Legal & Compliance Leaders provides research
    insights, advice, tools and data to address mission-critical
    priorities and keep up with the accelerating pace of business
    today.
    On the web, visit:
    gartner.com/en/legal-compliance

    Cookies [ 1 ] [ 2 ] Terms [ 1 ] [ 2 ] Privacy [ 1 ] [ 2 ] POW E RE D BY

    You might also like