What is Third-Party Risk Management?
Third-party risk management (TPRM) is a form of risk management that focuses on identifying and reducing risks relating to the use of third parties (sometimes referred to as vendors, suppliers, partners, contractors, or service providers).
The discipline is designed to give organizations an understanding of the third parties they use, how they use them, and what safeguards their third parties have in place. The scope and requirements of a TPRM program are dependent on the organization and can vary widely depending on industry, regulatory guidance, and other factors. Still, many TPRM best practices are universal and applicable to every business or organization.
While exact definitions may vary, the term “third-party risk management” is sometimes used interchangeably with other common industry terms, such as vendor risk management (VRM), vendor management, supplier risk management, or supply chain risk management. However, TPRM is often thought of as the overarching discipline that encompasses all types of third parties and all types of risks.
Why is Third-Party Risk Management Important?
While third-party risk isn’t a new concept, upticks in breaches across industries and a greater reliance on outsourcing have brought the discipline into the forefront like never before. Disruptive events, have impacted almost every business and their third parties – no matter the size, location, or industry. In addition, data breaches or cyber security incidents are common. In in 2021, the impact that third parties have on business resilience was highlighted through outages and other third-party incidents. Some of the ways you can be impacted are:
Most modern organizations rely on third parties to keep operations running smoothly. So, when your third parties, vendors, or suppliers can’t deliver, there can be devastating and long-lasting impacts.
For example, you may rely on a service provider such as Amazon Web Services (AWS) to host a website or cloud application. Should AWS go offline, your website or application also goes offline. An additional example could be the reliance on a third party to ship goods. If the shipping company’s drivers go on strike, that can delay expected delivery times and lead to customer cancellations and distrust, which will negatively impact your organization’s bottom line and reputation.
Outsourcing is a necessary component of running a modern business. It not only saves a business money, but it’s a simple way to take advantage of expertise that an organization might not have in house. The downside is that if a proper TPRM program is not in place, relying on third parties can leave your business vulnerable.
What are the Top TPRM Best Practices?
There are endless TPRM best practices that can help you build a better program, regardless of whether you’re just beginning to make TPRM a priority, or you want to understand where your existing program could be improved. We’ve outlined what we believe are the 3 most critical best practices that are applicable to nearly every company.
1) Prioritize Your Vendor Inventory
Not all vendors are equally important, which is why it is critical to determine which third parties matter most. To improve efficiency in your TPRM program, segment your vendors into criticality tiers.
Most companies segment vendors into three groups:
In practice, organizations will focus their time and resources on tier 1 vendors first, as they require more stringent due diligence and evidence collection. Typically, tier 1 vendors are subject to the most in-depth assessments, which often includes on-site assessment validation.
Many times, especially during initial evaluation, these tiers are calculated based on the inherent risk of the third party. Inherent risk scores are generated based on industry benchmarks or basic business context, such as whether or not you will be:
Additionally, impact of the vendor can be a determining factor. If a third party can’t deliver their service, how would that impact your operations? When there is significant disruption, the risk of the vendor will inevitably be higher. Determine this impact by considering:
Another way to tier vendors is by grouping based on contract value. Big-budget vendors may automatically be segmented as a tier 1 vendor due to the high risk based solely on the value of the contract.
2) Leverage Automation Wherever Possible
Efficiencies emerge when operations are consistent and repeatable. There are a number of areas in the TPRM lifecycle where automation is ideal. These areas include, but are not limited to:
Every TPRM program is different, so start by looking internally at the repeatable processes that are ripe for automation. From there, start small and take practical steps to automate key tasks. Over time, these small automations will compound, saving your team valuable time, money, and resources.
3) Think Beyond Cybersecurity Risks
When considering a third-party risk or vendor risk management program, many organizations immediately think aboutcybersecurity risks. But TPRM entails so much more. While starting small and focusing only on cybersecurity risks is a good first step, there are other types of risks that need to be prioritized. These risks include:
The key takeaway here is that understanding all relevant types of risk (and not just cybersecurity) is imperative to building a world-class TPRM program.
What is the Third-Party Risk Management Lifecycle?
The third-party risk management lifecycle is a series of steps that outlines a typical relationship with a third party. TPRM is sometimes referred to as “third-party relationship management.” This term better articulates the ongoing nature of vendor engagements. Typically, the TPRM lifecycle, is broken down into several stages. These stages include:
Phase 1: Third-Party Identification
There are many ways to identify the third parties your organization is currently working with, as well as ways to identify new third parties your organization wants to use.
To identify vendors already in use and build a vendor inventory, organizations take multiple approaches, which include:
To identify new third parties, organizations will often leverage a self-service portal as part of their third-party risk management program. With a self-service portal, business owners can build their inventory. Share the portal with your business by linking to it from your intranet or SharePoint. Self-service portals also help gather preliminary information about the third party, such as:
Using this information, you can classify third parties based on the inherent risk that they pose to your organization.
Phase 2: Evaluation and Selection
During the evaluation and selection phase, organizations consider RFPs and choose the vendor they want to use. This decision is made using a number of factors that are unique to the business and its specific needs.
Phase 3: Risk Assessment
Vendor risk assessments take time and are resource-intensive, which is why many organizations are using a third-party risk exchange to access pre-completed assessments. Other common methods include using spreadsheets or assessment automation software. Either way, the primary goal of understanding the risks associated with the vendor is the same.
Common standards used for assessing vendors include:
As well as industry-specific standards, such as:
Phase 4: Risk Mitigation
After conducting an assessment, risks can be calculated, and mitigation can begin. Common risk mitigation workflows include the following stages:
Phase 5: Contracting and Procurement
Sometimes done in parallel with risk mitigation, the contracting and procurement stage is critical from a third-party risk perspective. Contracts often contain details that fall outside the realm of TPRM. Still, there are key provisions, clauses, and terms that TPRM teams should look out for when reviewing vendor contracts.
Some of these include:
Home in on these key terms to report on requirements in a structured format. Simply determine if key clauses are adequate, inadequate, or missing.
Phase 6: Reporting and Recordkeeping
Building a strong TPRM program requires organizations to maintain compliance. This step is often overlooked. Maintaining detailed records in spreadsheets is nearly impossible at scale, which is why many organizations implement TPRM software. With auditable recordkeeping in place, it becomes much easier to report on critical aspects of your program to identify areas for improvement.
In practice, a sample reporting dashboard may include:
Phase 7: Ongoing Monitoring
An assessment is a “moment-in-time” look into a vendor’s risks; however, engagements with third parties do not end there – or even after risk mitigation. Ongoing vendor monitoring throughout the life of a third-party relationship is critical, as is adapting when new issues arise.
For example, new regulations, negative news stories, high-profile data breaches, and evolving usage of a vendor, may all impact the risks associated with your third parties. Some key risk-changing events to monitor include:
Phase 8: Vendor Offboarding
A thorough offboarding procedure is critical, both for security purposes and recordkeeping requirements. Many organizations have developed an offboarding checklist for vendors, which can consist of both an assessment sent internally and externally to confirm that all appropriate measures were taken. Critical too is the ability to maintain detailed evidence trail of these activities to demonstrate compliance in the event of regulatory inquiry or audit.
Which Department Owns TPRM?
There is no one-size-fits-all approach to third-party risk management. All companies are different, and as a result, there is no set-in-stone department that owns vendor risk responsibilities. Some mature organizations may have a third-party risk or vendor management team, but many organizations do not. As a result, common job titles and departments that “own” third-party risk include:
The list above is by no means comprehensive; however, the diverse variety of titles and departments can shed some light on the diverse approaches taken to third-party risk management.
Ultimately, these stakeholders and departments must work together to manage vendors throughout the third-party lifecycle. As such, TPRM often extends into many departments and across many different roles.
What are the Benefits of Third-Party Risk Management Software?
With third-party risk software, your organization can develop and scale a successful TPRM management program that adds value to your bottom line. The return on investment (ROI) is significant when leveraging the automation opportunities that purpose-built software provides. The biggest benefits include:
How Can OneTrust Help?
The OneTrust platform leverages expertise in GRC, specializing in Third-Party Risk Management, Privacy, Incident Management, and many other categories to deliver an immersive security and privacy management experience. Reduce your vendor, supplier, and third-party risks with OneTrust Third-Party Management software and Third-Party Risk Exchange. The software enables you to run compliance checks and screen vendors. Additionally, our software empowers organizations to conduct vendor risk assessments and mitigate risks through highly customizable workflow automation. The OneTrust Third-Party Risk Exchange enables businesses to access to risk analytics and control gap reports on vendors, and provides vendors with an opportunity to centralize their compliance details and promote them to thousands of OneTrust customers to easily share.