What is Third-Party Risk Management?

Third-party risk management (TPRM) is a form of risk management that focuses on identifying and reducing risks relating to the use of third parties (sometimes referred to as vendors, suppliers, partners, contractors, or service providers).

The discipline is designed to give organizations an understanding of the third parties they use, how they use them, and what safeguards their third parties have in place. The scope and requirements of a third-party risk management program are dependent on the organization and can vary widely depending on industry, regulatory guidance, and other factors. Still, many TPRM best practices are universal and applicable to every business or organization.

While exact definitions may vary, the term “third-party risk management” is sometimes used interchangeably with other common industry terms, such as vendor risk management (VRM), vendor management, supplier risk management, or supply chain risk management. However, TPRM is often thought of as the overarching discipline that encompasses all types of third parties and all types of risks.

Why is third-party risk management important?

While third-party risk isn’t a new concept, recent events and a greater reliance on outsourcing have brought the discipline into the forefront like never before. Disruptive events, such as the COVID-19 pandemic, have impacted almost every business and their third parties – no matter the size, location, or industry. In addition, data breaches or cyber security incidents are common. In fact, more than half of the breaches that have occurred over the past two years were caused by a third party.

Most modern organizations rely on third parties to keep operations running smoothly. So, when your third parties, vendors, or suppliers can’t deliver, there can be devastating and long-lasting impacts.

For example, you may rely on a service provider such as Amazon Web Services (AWS) to host a website or cloud application. Should AWS go offline, your website or application also goes offline. An additional example could be the reliance on a third party to ship goods. If the shipping company’s drivers go on strike, that can delay expected delivery times and lead to customer cancellations and distrust, which will negatively impact your organization’s bottom line and reputation.

Outsourcing is a necessary component of running a modern business. It not only saves a business money, but it’s a simple way to take advantage of expertise that an organization might not have in house. The downside is that if a proper third-party risk management program is not in place, relying on third parties can leave your business vulnerable.  

What are the top TPRM best practices?

There are endless third-party risk management best practices that can help you build a better program, regardless of whether you’re just beginning to make TPRM a priority, or you want to understand where your existing program could be improved. We’ve outlined what we believe are the 3 most critical best practices that are applicable to nearly every company.

1. Prioritize Your Vendor Inventory

Not all vendors are equally important, which is why it is critical to determine which third parties matter most. To improve efficiency in your TPRM program, segment your vendors into criticality tiers.

Most companies segment vendors into three groups:

In practice, organizations will focus their time and resources on tier 1 vendors first, as they require more stringent due diligence and evidence collection. Typically, tier 1 vendors are subject to the most in-depth assessments, which often includes on-site assessment validation.

Many times, especially during initial evaluation, these tiers are calculated based on the inherent risk of the third party. Inherent risk scores are generated based on industry benchmarks or basic business context, such as whether or not you will be:

Additionally, impact of the vendor can be a determining factor. If a third party can’t deliver their service, how would that impact your operations? When there is significant disruption, the risk of the vendor will inevitably be higher. Determine this impact by considering:

Another way to tier vendors is by grouping based on contract value. Big-budget vendors may automatically be segmented as a tier 1 vendor due to the high risk based solely on the value of the contract.

2. Leverage Automation Wherever Possible

Efficiencies emerge when operations are consistent and repeatable. There are a number of areas in the third-party risk management lifecycle where automation is ideal. These areas include, but are not limited to:

Every third-party risk management program is different, so start by looking internally at the repeatable processes that are ripe for automation. From there, start small and take practical steps to automate key tasks. Over time, these small automations will compound, saving your team valuable time, money, and resources.

3. Think Beyond Cybersecurity Risks

When considering a third-party risk or vendor risk management program, many organizations immediately think about cybersecurity risks. But TPRM entails so much more. While starting small and focusing only on cybersecurity risks is a good first step, there are other types of risks that need to be prioritized. These risks include:

The key takeaway here is that understanding all relevant types of risk (and not just cybersecurity) is imperative to building a world-class third-party risk management program.

What is the third-party risk management lifecycle?

The third-party risk management lifecycle is a series of steps that outlines a typical relationship with a third party. TPRM is sometimes referred to as “third-party relationship management.” This term better articulates the ongoing nature of vendor engagements. Typically, the TPRM lifecycle, is broken down into several stages. These stages include:

  1. Vendor identification
  2. Evaluation & selection
  3. Risk assessment
  4. Risk mitigation
  5. Contracting and procurement
  6. Reporting and Recordkeeping
  7. Ongoing monitoring
  8. Vendor offboarding

Phase 1: Vendor Identification

There are many ways to identify the third parties your organization is currently working with, as well as ways to identify new third parties your organization wants to use.

To identify vendors already in use and build a vendor inventory, organizations take multiple approaches, which include:

To identify new vendors, organizations will often leverage a self-service portal as part of their third-party risk management program. With a self-service portal, business owners can build your inventory. Share the portal with your business by linking to it from your intranet or SharePoint. Self-service portals also help gather preliminary information about the third party, such as:

Using this information, you can classify vendors based on the inherent risk that they pose to your organization.

Phase 2: Evaluation and Selection

During the evaluation and selection phase, organizations consider RFPs and choose the vendor they want to use. This decision is made using a number of factors which are unique to the business and its specific needs.

Phase 3: Risk Assessment

Vendor risk assessments take time and are resource intensive, which is why many organizations are using a third-party risk exchange to access pre-completed assessments. Other common methods include using spreadsheets or assessment automation software. Either way, the primary goal of understanding the risks associated with the vendor is the same.

Common standards used for assessing vendors include:

As well as industry-specific standards, such as:

Phase 4: Risk Mitigation

After conducting an assessment, risks can be calculated, and mitigation can begin. Common risk mitigation workflows include the following stages:  

  1. Risk flagging and score designation
  2. Evaluation of risk against your organization’s risk appetite definition
  3. Treatment and control validation in the scope of your desired residual risk level.
  4. Continual monitoring for increased risk levels (e.g. data breaches)  

Phase 5: Contracting and Procurement

Sometimes done in parallel with risk mitigation, the contracting and procurement stage is critical from a third-party risk perspective. Contracts often contain details that fall outside the realm of TPRM. Still, there are key provisions, clauses, and terms that TPRM teams should look out for when reviewing vendor contracts.

Some of these include:

Hone in on these key terms to report on requirements in a structured format. Simply determine if key clauses are adequate, inadequate, or missing.

Phase 6: Reporting and Recordkeeping

Building a strong TPRM or VRM program, requires organizations to maintain compliance. This step is often overlooked. Maintaining detailed records in spreadsheets is nearly impossible at scale, which is why many organizations implement TPRM software. With auditable recordkeeping in place, it becomes much easier to report on critical aspects of your program to identify areas for improvement.

In practice, a sample reporting dashboard may include:

Phase 7: Ongoing Monitoring

An assessment is a “moment-in-time” look into a vendor’s risks; however, engagements with third parties do not end there – or even after risk mitigation. Ongoing vendor monitoring throughout the life of a third-party relationship is critical, as is adapting when new issues arise.

For example, new regulations, negative news stories, high-profile data breaches, and evolving usage of a vendor, may all impact the risks associated with your third parties. Some key risk-changing events to monitor include:

Phase 8: Vendor Offboarding

A thorough offboarding procedure is critical, both for security purposes and recordkeeping requirements. Many organizations have developed an offboarding checklist for vendors, which can consist of both an assessment sent internally and externally to confirm that all appropriate measures were taken. Critical too, is the ability to maintain detailed evidence trail of these activities to demonstrate compliance in the event of regulatory inquiry or audit.

Which department owns TPRM?

There is no one-size-fits-all approach to third-party risk management. All companies are different, and as a result, there is no set-in-stone department that owns vendor risk responsibilities. While some mature organization may have a third-party risk or vendor management team, but many organizations do not. As a result, common job titles and departments that “own” third-party risk include:

The list above is by no means comprehensive; however, the diverse variety of titles and departments can shed some light on the diverse approaches taken to third-party risk management.

Ultimately, these stakeholders and departments must work together to manage vendors throughout the third-party lifecycle. As such, TPRM often extends into many departments and across many different roles.

What are the benefits of third-party risk management software?

With third-party risk software, your organization can develop and scale a successful TPRM management program that adds value to your bottom line. The return on investment (ROI) is significant when leveraging the automation opportunities that purpose-built software provides. The biggest benefits, include:

Want to see how OneTrust Vendorpedia can help your organization streamline third-party risk management? Request a demo today!