Manage Third Party Risk Exposure In An Interconnected World

Realize that everything connects to everything else.
Leonardo da Vinci

The world is flat, risk is pervasive, and organizations have no boundaries. We operate in a global and interconnected world. Organizations are no longer defined by brick and mortar walls nor by employees. The term insider used to be a synonym for employee. Today, more than half of insiders in many organizations are not employees. Organizations are a complex web of vendors, suppliers, contractors, consultants, temporary workers, service providers, outsourcers, brokers, dealers, intermediaries and agents.

In this interconnected world; governance, risk management, and compliance (GRC) are no longer defined by traditional organization boundaries that no longer exist. The organization must holistically look at the web of relationships that form the organization and nest in deep supply chains and subcontractor relationships. Third party risk is the organizations risk. Their issues are your issues. Their compliance and ethics problems are your problems.

Consider the wit of Douglas Adams in this context . . .

The connections between causes and effects are often much more subtle and complex than we with our rough and ready understanding of the physical world might naturally suppose . . . Let me give you an example. If you go to an acupuncturist with a toothache, he sticks a needle instead into your thigh. Do you know why he does that . . .?
― Douglas Adams, Dirk Gently’s Holistic Detective Agency

The exposure organizations face from third party relationships is significant. These include:

• Bribery, Corruption & Fraud
• Business Continuity
• Contractual
• Financial
• Environmental
• Ethical
• Geo-Political
• Health & Safety
• Human Rights, Trafficking & Slavery
• Import/Export & Customs
• Labor Standards
• Legal
• Privacy
• Operational
• Regulatory Compliance
• Reputational
• Sanctions
• Security
• Strategic
• Sourcing

Third party regulation and legislation has been particularly active over the past few years. Consider a fraction of what is happening:

• Bribery & Corruption. We have seen expanded and increased enforcement of the US FCPA, with a focus on effective compliance. The UK Bribery Act has been in place for a few years with enforcement happening. There also is expanding regulation globally on bribery and corruption.
• Conflict Minerals. As part of the Dodd Frank Act, thousands of companies have gone through two years of compliance with conflict mineral requirements and reporting. US publicly traded companies have to trace tin, tantalum, tungsten, and gold to see if they come from the Democratic Republic of the Congo or nine surrounding countries known for crimes against humanity and report on this.
• FTC Power to Sue in Data Breach. This past August the U.S. Court of Appeals for the Third Circuit affirmed in FTC v Wyndham the FTC powers to sue organizations in the event of a data breach. Given over half of insiders in many organizations are third parties and the variety of breaches that involved a third party, this is going to cause increased scrutiny and attention in third party risk management.
• OCC Regulations of Third Party Risk Management. The OCC has significantly expanded vendor risk management requirements in financial services over the past several years, making this a board level issue. Besides a legion of banks asking me questions, I am getting regular inquiries for third party relationships of banks that are responding to the greater scrutiny of the banks they do business with.
• PCI DSS. In version 3 of PCI DSS we have seen expanded requirements on IT vendor risk assessments in context of contractual requirements if you accept major credit cards. I fully expect this to expand further in the next version after the Target incident that exposed millions of credit cards and the doorway into the breach was a heating and air-conditioning vendor that had a connection to the Target network. A hacker breached this vendor, got into Target IT systems and compromised point of sale systems across Target.
• U.K. Modern Slavery Act. This really surprises me as I am not seeing organizations reacting to it. This past October the Modern Slavery Act went into effect and impacts a wide range of organizations. Basically, if you supply goods or services, have any connection into the United Kingdom, such as a single employee, and do ￡36 million or more in revenue regardless of size of your UK operations, you need to prepare an annual Slavery and Human Trafficking statement detailing the steps it is taking to prevent slavery and human trafficking throughout its business and third party relationships (down into the depth of supply chains). The guidance given on this statement requests organizations detail:
  • Organization structure, operations, and map of supply chains
  • Policies and procedures related to slavery and human trafficking
  • Due diligence processes to prevent slavery and human trafficking
  • Risk assessment of the organization and suppliers where there is risk of slavery and human trafficking
  • Key performance indicators that the organization uses to benchmark effectiveness in preventing slavery and human trafficking
  • Training conducted with employees and third parties/suppliers in context of anti-slavery and human trafficking

These risks are complex and interconnected themselves. Third party risk cannot be managed in isolated and disconnected silos. It requires an integrated process of third party governance, risk management, and compliance throughout the lifecycle of third party relationships. However, many organizations manage third party risk in ad hoc siloed manners with different departments doing things in different ways, disconnected and redundant. These processes are usually inefficient and costly as they require significant amount of time compounded as the number of third party relationships grows in organizations.

An integrated and effective third party management process enables the organization to consistently manage the lifecycle of third party relationships across:

1. On-boarding. Automate the process of standardizing the identification of third parties to work with and moving them through registration and on-boarding while collecting required third party information and conducting appropriate due-diligence in context of the nature of the relationship. This includes third party:
   • Identification
   • Qualification
   • Contracting
   • On-boarding
2. Ongoing communication processes. The organization manages the ongoing periodic tasks of communications, attestations and interactions with third parties. This includes cyclical and event driven interactions with each third party on:
   • Policies
   • Training
   • Attestation
   • Self-assessments/questionnaires
   • Reporting
3. Monitoring processes. Enable the management and automation of the array of processes to continuously monitor third party relationships over their lifecycle in the organization. This includes third party:
   • Performance monitoring
   • Risk monitoring
   • Compliance monitoring
   • Ongoing due diligence monitoring
   • Issue reporting & resolution
   • Audit & inspections
4. Forms & approvals. Manage the development and automation of internal processes to collect and report information and route things for approval in context of third party relationships. This includes:
   • New vendor/supplier request
   • Gifts, hospitality & entertainment
   • Political & charitable contributions
   • Facilitated payments
5. Metrics & reporting. Through a solid information architecture and reporting engine, the organization brings together the data elements of the entire lifecycle to provide end-to-end reporting and metrics on third party relationships at the relationship level, risk area, or in aggregate.
6. Renewal or Off-boarding. Utilizing the detailed history of interactions, issues, performance, non-conformance, and evolving risk scenarios, the organization manages the processes to evaluate, maintain, and renew third party relationships. All good things must come to an end, the third party management lifecycle is concluded by managing the tasks and details many organizations neglect, or forget, in off-boarding relationships that are no longer needed.

To accomplish an integrated third party management process requires that the organization formulate an overall third party management strategy and process that spans roles and functions involved. This is supported by an integrated and consistent third party information and technology architecture to provide a holistic system of record and accountability across internal functions and third parties.

However, the market has a maze of solutions to offer organizations. GRC 20/20 current tracks and monitors over 130 third party management technology solutions and over 50 third party information/content offerings. Some of these solutions are broad and meant to support a holistic integrated third party management program while others are very function and issue specific. Navigating the maze of offerings and selecting the right elements to build a third party information and technology architecture is not a trivial task. GRC 20/20 is here to help organizations understand the range of solutions available and select the right solution(s) for each organization specific third party management strategy and process, whether this is an integrated third party management strategy as proposed, or for a specific function or issue. Organizations looking for third party management solutions and intelligence can get objective insight through:

• Research Briefing: How to Purchase Third Party Management Solutions
• Inquiry: Organizations looking for solutions can ask GRC 20/20 questions via inquiry or phone to get our insight (request inquiry via web or email [email protected])
• Workshops: host or attend GRC 20/20’s Third Party Management by Design Workshop (email [email protected])
• RFP Development & Support: engage GRC 20/20’s research and compendium of hundreds of third party management solution requirements into an RFP that is crafted to meet your organizations specific requirements (email [email protected])

8JAN2016:
HOW TO PURCHASE 3RD PARTY MANAGEMENT SOLUTIONS CONSIDERATIONS IN SELECTION OF A 3RD PARTY MANAGEMENT PLATFORM
10:00 am - 11:00 am CST