Managing third party risk without losing sleep

Although the use of third parties can bring cost efficiency and operational flexibility, it can also introduce potential vulnerabilities. So how do you manage it? Through a robust third-party risk management programme that identifies, prioritises, and monitors these risks.

Ben Langford and Robert Shaw share common challenges businesses face when managing third-party risk so you can prepare. Plus, find out how The Institute of Internal Auditors recently issued Topical Requirement on Third Parties can help you. 

Third-party risks — what’s really at stake?

Third-party relationships can expose your organisation to risks that go far beyond operational hiccups. These risks can impact compliance, reputation, and even business continuity. Here are some of the most critical areas to watch:

• Operational resilience
• Ethical and regulatory compliance (such as bribery & corruption, trade sanctions & export controls, fraud)
• Performance and delivery, such as quality, reliability, training.
• Financial, such as failure of third-party.
• Cybersecurity and data privacy, such as system vulnerabilities and GDPR compliance.
• Climate and sustainability
• Social and Human Rights including Modern Slavery 

Don’t just spot risks — manage them

Identifying risks is only half the battle. To truly protect your organisation, you need to embed risk management throughout the entire third-party lifecycle. Here’s what that looks like:

• Requirement specification and supplier selection, includes processes to determine the need for a third party, the plan for its use, and the criteria for selection.
• Due diligence and contracting, includes due diligence with the third party and implementing a legal agreement
• Onboarding and mobilisation, begins when the contract is signed to start the relationship and establishes a foundation for third parties to meet the terms of the contract or agreement
• Contract delivery, includes processes for “in-life” management and ongoing monitoring of the third party after the contract has been established and approved. The approach is usually systematic and risk-based and should consider continuous improvement. This includes managing contract variations and scope changes.
• Offboarding, includes processes for ending contracts and agreements, maintaining an exit strategy for third parties that have been prioritized based on risk, and terminating relationships when necessary. The processes typically use a risk-based approach and may involve a formal exit plan

At a governance level, it’s important to define an approach supported by clear policies and procedures. Roles and responsibilities for working with third parties should be well-defined, along with clarity on who the key stakeholders are across the business. These may include the board, senior management, operations, risk management, HR, IT, finance, legal & compliance, and procurement. Ensuring third parties align with your company’s values and ethics is equally critical.

Risk management processes around third parties should be sufficient to identify, prioritise, mitigate and monitor risk across the third-party life cycle and the full risk universe.

Simple questions to better understand your third-party landscape

A strong risk management framework starts with asking the right questions. Use these prompts to uncover gaps and prioritise actions:

What’s next?

• Map your third-party landscape and prioritise critical relationships.
• Benchmark your processes against IIA’s Topical Requirement on Third Parties.

Build a governance framework that enforces accountability and transparency.

If you’d like to have an exploratory conversation or find out more information, contact Ben Langford.