Blog

The shift to third-party management (TPM): What is TPM and why does it matter?

January 25, 2022

What is third-party trust management?
Different third-party trust management tools
Who does third-party trust management matter to?
Best practices for TPTM
How can OneTrust help with TPTM?

As the security landscape has evolved, organizations have opened themselves to more risk vectors than ever before — and that number will only continue to climb. Traditionally, the corporate vendor ecosystem — the community of third parties a company shares information with — is analyzed under the lens of third-party risk management (TPRM). More recently, the third-party risk community has seen a major shift to emphasizing the criticality of Ethics and ESG (environmental, social, and governance), pushing risk and security professionals to reconsider the way these implementations are managed.

As a result, a fundamental shift from Third-Party Risk Management to Third-Party Management (TPM) has begun.

What is third-party trust management?

Trust-First Third-Party Management (TPM) is the next evolution of third-party risk and a facet of overall enterprise trust strategy. It goes beyond cybersecurity and focuses on building trusted and lasting third-party relationships across the core critical risk domains: security, privacy, ethics & compliance, and ESG. Specifically, Third-Party Management (TPM) is a discipline of enterprise trust that focuses on the impact a third party has on an organization across each pillar.

Download the eBook to learn more about the shift to Third-Party Management and what it means for your business.

Defining the pillars of third-party trust

As consumer wants, shareholder needs and due diligence expectations for businesses have evolved, modern third-party risk considerations need to consider ethics and ESG as key risk domains in addition to security and privacy. Here’s a deeper look at each category under the TPM umbrella:

Security: Security encompasses two key focus areas, Governance, Risk, Compliance (GRC) and Vendor Risk Management (VRM). In TPM, security considerations focus on the identification, analysis, and mitigation of cybersecurity risks as it relates to third parties.
Environmental, Social, and Governance (ESG): ESG and Ethics programs are emerging as key components of a cross-organizational strategy. In TPM, ESG considerations focus on analyzing the reputational risk of working with a third party or supplier as it relates to Environmental, Social, and Governance concerns.
Ethics: Ethics, like ESG, is emerging as a key component of business strategy. In TPM, ethics considerations focus on conducting compliance checks and screening third parties as well as continuously monitoring them for concerns relating to adverse media as well as issues around corruption, politically exposed persons (PEP), sanctions lists, and beneficial ownership.
Privacy: Privacy encompasses a wide array of subject matter, with a key focus on Consent & Preference Management and Data Governance. In TPM, privacy considerations focus on the protection of personal data and demonstration of compliance as pertains to personal information with an organization’s third parties.At its core, Third-Party Management is about bringing these pillars together to gain a holistic understanding of all risk and opportunities relating to a third party.

Download the eBook to learn more about the shift to Third-Party Management and what it means for your business.

What are the different third-party trust management tools?

While TPM focuses on breaking down siloes and aligning workflows across teams, it’s important to consider that third-party security and privacy analysis may require a different set of functionalities than those focused on analyzing the ethics or ESG risk relating to a third party. Third-Party management programs require solutions that fit the individual needs of involved stakeholders, while still enabling seamless data sharing and collaboration. TPM considers the following tools as key facets of broader trust management software:

Third-Party Risk Management Software: Third-party risk management software empowers reassessment and risk monitoring by focusing on reducing security and privacy risks, solving challenges such as automating vendor security and privacy assessments, managing and monitoring your vendor inventory, and streamlining risk mitigation. TPRM software enables a business to conduct risk assessments, implement AI questionnaire autocompletion, streamline risk mitigation workflows and automate recordkeeping to meet the needs of security and privacy professionals across the enterprise.
Third-Party Due Diligence Software: Third-party due diligence software empowers due diligence monitoring by focusing on ethics & compliance risks, helping to automate onboarding, conduct compliance checks and screening, analyze risks, provide treatment plans, and maintain ongoing oversight by monitoring key concerns, such as adverse media. TPDD software enables a business to stand up onboarding automation solutions, compliance checks, vendor screening, risk analysis, treatment plans and contextual alerts to meet the needs of ethics professionals across the enterprise.
Supplier Sustainability and Responsibility: Supplier sustainability and responsibility software empowers supplier ESG monitoring by focusing on flagging ESG risks, helping organizations to understand and monitor the sustainability and responsibility initiatives of their suppliers in order to inform internal ESG program metrics as well as generate public-facing ESG reports. Visibility into supplier sustainability and responsibility enables a business to stand up ESG assessment technology, understand and track industry standards, conduct reputation risk analysis and implement targets and scorecards to meet the needs of ESG professionals across the enterprise.

Currently, third-party risk management tools are siloed and static, operating independently of one another and through manual processes. TPM focuses on the value of a singular workflow across the enterprise and encourages the implementation of a comprehensive approach, encouraging businesses to move away from spreadsheet-based work. Third-Party management also calls for the centralization and customization of workflows so each team is able to access the specific information needed to execute role-specific tasks efficiently.

Who does third-party trust management matter to?

Your third parties reflect your organization’s value. As a result, third-party management has wide-ranging implications.

Consumers: Consumers are increasingly skeptical of the brands that they engage with. Especially when it comes to commoditized goods, being a trusted brand gives you a competitive advantage with consumers by increasing their confidence in your treatment of their data, their privacy, their communities, and the environment.
Employees: Employees have more choice of how, where, and what they work on. This empowers talent to be increasingly selective about the brands that they represent. Individuals have an increased focus on their personal brand, and that aligns with not only where they shop, but also the companies that they work for, meaning that they’ll seek out brands who understand the impact of both their internal actions and the impact that a brand’s third parties and partners have on their community.
Investors & Partners: As trust increases and brand reputation stays a key factor in market valuation, partners and investors are holding brands they work with to higher standards and levels of accountability than ever before. Investment trends show that this will now exceed expectations in the realm of privacy and security and reflect those of trust.

Best practices for TPTM

When actioning TPM across the enterprise, there are 5 important steps to consider:

Define what trust means to your business: What’s acceptable to your business? Define your business needs and what trust expectations you have. Do you need a formal committee or process that reviews third parties across numerous risk domains? Do you understand what risk looks like throughout the entire third-party lifecycle? Do your vendor contracts take into consideration trust metrics you care about, such as sustainability or ethics? Most importantly, is the organization in alignment with the answers to these questions?
Define your risk appetite across domains: What are your company’s trust priorities, and what matters most to your ideal buyer? What is your weighted scale across the domains of security, privacy, ESG and ethics? How do you implement and measure that effectively?
Tier your third parties: any organizations tier third parties into three categories — low risk, moderate risk, and high risk — using a number of different factors, such as:
- Are you sharing proprietary or confidential business information with the vendor?
- Are you sharing personal data with the third party?
- Are you sharing sensitive personal data with the third party?
- Are you sharing personal data across borders? e. Is the vendor serving critical business functions?
- What is the potential effect to your organization in the event of unauthorized disclosure of information?
- What is the potential effect to your organization in the event of unauthorized modification or destruction of information?
- What is the potential effect to your organization in the event of disruption of access to or use of the third party?
- What potential ESG impacts are involved with working with the third party?
- What potential ethical or reputational impacts are involved with working with the third party?
Establish processes and automate workflows: Workflows should be customizable, can vary by the third party, and are made possible by technology. Moving away from manual, static processes is the best way to streamline your TPM process across all domains and stakeholders considered.
Vary your assessment depth: Ensuring that there is variation in your assessment depth is key to implementing a comprehensive TPM strategy. One-size-fits-all assessments are resource-intensive and often leave out key information when applied across domains. Automating your workflows will enable your organization to reduce repetition and customize assessments per risk domain, ensuring the correct depth is achieved based on how the vendor responds.

Download the eBook to learn more about the shift to Third-Party Management and what it means for your business.

Examples of TPTM workflow automation

How can OneTrust help with TPTM?

Third-Party Trust Management is the next step for Third-Party Risk Management. It goes beyond cybersecurity and focuses on building trusted and lasting third-party relationships across the core critical risk domains: security, privacy, ethics & compliance, and ESG. OneTrust offers technologies that enable organizations to build word-class Third-Party Trust programs by bringing together multiple stakeholders across disciplines to streamline workflows, reduce time spent on manual and redundant processes, and build trust with third parties. To do so, the OneTrust platform leverages expertise in privacy and data governance, GRC and security assurance, ethics and compliance, and ESG.

Your partner in trust transformation

Privacy Matters

Our privacy center makes it easy to see how
we collect and use your information.

Your privacy

When we collect your personal information, we always inform you of your rights and make it easy for you to exercise them. Where possible, we also let you manage your preferences about how much information you choose to share with us, or our partners.

Blog

The shift to third-party management (TPM): What is TPM and why does it matter?

Table of contents

What is third-party trust management?

Defining the pillars of third-party trust

What are the different third-party trust management tools?

Who does third-party trust management matter to?

Best practices for TPTM

Examples of TPTM workflow automation

How can OneTrust help with TPTM?

You may also like

Third-Party Risk

Live demo: Building your third-party risk management program with OneTrust

Register for this live demo to learn more about OneTrust Third-Party Risk Management solutions.

July 24, 2024

Third-Party Risk

Protecting your reputation: 3 ways a unified third-party management program can help

This webinar will show you how to develop strategies for assessing reputational risks as it relates to third parties and the impact of third-party relationships.

June 12, 2024

Third-Party Risk

Third-Party risk management and due diligence: What's the difference and why does it matter?

In this webinar, we’ll discuss the unique competencies of third-party risk and due diligence programs and examine when and how to align them.

May 08, 2024

Third-Party Risk

Live demo EMEA: Building your third-party risk management program with OneTrust

Join our webinar to learn how you can build an well-rounded Third-Party Risk Management Program that works for your organisation

April 23, 2024

Third-Party Risk

5 Best practices for increasing resilience when working with third parties webinar

Learn how to leverage financial, operations, compliance, ESG, and cyber scores to drive resilience insights and detect possible supply chain disruptions.

April 18, 2024

Third-Party Risk

OneTrust third-party management demo video

Watch this demo video to learn how OneTrust third-party management helps organizations create resilient, secure, and scalable third-party ecosystems.

April 04, 2024

Third-Party Risk

6 steps to effective third-party risk management

See the path to managing third-party risk effectively with a checklist that outlines the six steps for a sound TPRM program.

March 29, 2024

Third-Party Risk

TPRM privacy compliance: 10 best practices when working with third parties

How can you build a privacy-focused TPRM program? In this webinar, we discuss best practices for privacy compliance when working with third parties, from onboarding to offboarding.

March 13, 2024

Third-Party Risk

6 must-know trends in third-party management

Watch this video for the five top trends shaping the third-party management industry this year.

February 15, 2024

AI Governance

Questions to add to existing vendor assessments for AI

Managing third-party risk is a critical part of AI governance, but you don’t have to start from scratch. Use these questions to adapt your existing vendor assessments to be used for AI.

January 31, 2024

Third-Party Risk

4 top-of-mind challenges for CISOs in 2024

What key challenges do CISOs face going into the new year? Download this infographic to hear what experts from industries across the board have to say.

January 30, 2024

Third-Party Risk

A look back at 2023 & third-party management trends for the new year

Join this webinar as we discuss key trends for third-party management and lessons learned over the last year.

January 24, 2024

Third-Party Risk

Live demo EMEA: Master third-party risk management with OneTrust

Attend this demo to see how our TPRM solution can help you identify and mitigate risk as well as automate manual and repetitive tasks to ultimately reduce the time you spend managing your vendors

January 23, 2024

Third-Party Risk

Utilizing inherent risk for more efficient third-party management

Insight into your third parties’ inherent risks can change the way you run your TPM program.

November 30, 2023

Third-Party Risk

Elevating third-party safety: The art of TPRM and TPDD integration

Join our webinar to learn the primary goals of successful Third-Party Risk and Third-Party Due Diligence programs.

November 21, 2023

Ethics Program Management

Ethics Exchange: Risk assessments

Join our risk assessments experts as we discuss best practices, program templates, and how provide an assessment that provides the best value for your organization.

October 25, 2023

Third-Party Risk

5 Ways to save time when assessing third parties for privacy and security risks webinar

Join our webinar and learn how to save time and streamline third-party risk assessment throughout the TPRM lifecycle.

October 25, 2023

Third-Party Risk