THE EVOLUTION OF THIRD-PARTY RISK MANAGEMENT PROCESSES

Starting in the late 2000’s, financial institutions began to realize that their traditional Risk Management, Compliance, and Audit functions could not adequately manage the risks emerging from the significant increase in the size and scope of third-party relationships. Regulators throughout the globe also started to publish new guidance on third-party risk management significantly heightening awareness and raising expectations.

Since then, much has been learned, leading to several globally accepted standards.

Typically, an effective third-party risk management process follows a continuous life cycle made up of five phases: Planning, Due diligence & third-party selection, Contract negotiation, Ongoing monitoring, Termination/Renewal. The risk management processes carried out throughout these five phases seek to identify, assess, and mitigate risks inherent in third-party relationships. The numerous actions under each phase require a thorough understanding of the level of risk and complexity of the third-party relationships commensurate with the company’s strategic goals and risk appetite.

Although there is wide acceptance of this high-level framework, the adequacy of organizational structures, process, and technologies adopted by companies in designing and implementing supporting policies and standards vary significantly. A key factor in establishing an effective third-party risk management process is recognizing the need for new skills and new tools; relying exclusively on old legacy practices and processes no longer provides protection. While financial institutions have been expanding staffing and increasing spending for their third-party risk management (“TPRM”) programs, without proper expertise, a number of these efforts lead to over-engineered processes and yet fail to achieve acceptable levels of control and risk mitigation.

Companies with the most effective risk programs ensure engagement at the most senior levels including the Board of Directors and C-Suite. The same rule applies to managing third-party risk regardless of who owns the TPRM function. After all, while a financial institution can outsource the work, it cannot outsource the responsibility, nor the accountability.

CHANGING RISK LANDSCAPE

 Thanks to an ever changing and evolving third-party risk landscape, many new, and arguably more dangerous threats have been emerging:

• Cyber risk is ranked number one among many third-party risk experts. Concerns range from ransomware or malware infiltration due to third-party access points, as well as data breaches, outages, and data leakage
• IT complexities have increased as more organizations allow employees to work from home with different levels of remote access security measures in place
• Dedicated Company Devices vs. Multi-use Employee Devices introduce yet an additional level of risks from reputational to technology
• Labor shortages are forcing companies to hire a higher number of contractors to fill gaps, which expands security risk
• Automation has led to increased utilization of external software developers, which also increased the potential risk of malicious code being inserted into software updates
• Organizations have limited, if any direct oversight of 4^th (or 5^th, N^th) parties even when they handle critical functions. Given this high degree of difficulty many firms have defaulted to relying on legal agreements in lieu of performing their own due diligence in the form of onsite audits and compliance. This has worked well until there is a problem
• Crisis Management capabilities took on a whole new importance during the pandemic because of financial institutions’ reliance on critical services provided by third parties
• Geo-political events recently brought to question the sustainability of globalization. Because of supply chain disruptions created by everything from so-called “acts of god” to force majeure the vulnerabilities created by this outsourcing strategy have been painfully highlighted. There is serious consideration by organizations to insource, onshore, if not near-shore products and services from their current locations. These developments raise significant concerns over the use of third parties going forward

In the meantime, regulators around the globe have been tightening their expectations through new and revised guidance on several risk areas, such as, Privacy, Governance Risk and Compliance (GRC) practices, and Disaster recovery. There is no doubt, this list will continue to grow and expand the span of TPRM. The recent introduction of ESG requirements and Scope 3 responsibilities parallel many of the challenges that firms face with third-party management and may provide possible new tools and therefore should be closely watched.

Besides the obvious business impairment risks of third-party provider problems, there is the added desire to align with regulatory expectations and avoid deficiencies in supervisory examinations. Since regulators typically define “what” they expect but remain silent on the “how”, the design and the effectiveness of TPRM programs vary significantly from organization to organization.

BEST PRACTICES

Today's operating environment is profoundly different even when compared to a few years ago. Digital technology, advanced risk analytics, along with regulatory and compliance expertise have emerged as key organizational assets helping drive important strategic and operational decisions. While there is a much stronger understanding of the need to better manage third-party risk today, some organizations are still struggling to determine how best to go about it.

The good news is several best practices have been developed over time, such as:

• Having stakeholders with the right level of ownership and accountability
• Establishing policy and standards that ensure consistency
• Developing dedicated third-party oversight expertise and recognizing the needs for hands-on oversight at the point of actual delivery
• Obtaining greater transparency into suppliers’ operations through data management, dashboard tracking, and analysis
• Proactively identifying, assessing, and monitoring risk areas
• Staying on top of regulatory expectations

Financial institutions can also drill down into these Best Practices by asking some key questions:

• Is the TPRM framework supported by a well-defined organizational structure, processes, and tools?
• Does the TPRM program follow the continuous life cycle of Planning, Due diligence & third-party selection, Contract negotiation, Ongoing monitoring, Termination/Renewal?
• Are TPRM roles and responsibilities and ownership at 1^st, 2^nd, 3^rd lines of defense well-defined, well-documented and executed?
• Is there a clear escalation policy for when issues are raised and robust follow-up procedures in place?
• Is there a comprehensive training program to educate all stakeholders involved in the TPRM process?
• Is there an experienced TPRM leadership team with the unique skills required in place to oversee the TPRM program?

Let our team of TPRM experts assist your board and senior management team to establish a successful, well managed third-party risk management program that includes proper structure, processes, and technologies to keep your business and institution safe and comply with regulatory expectations.

Our goal is to help you achieve your goal of maximizing your third-party relationships while minimizing the embedded business and regulatory risks in the most efficient and effective manner, leveraging our knowledge of industry best practices.

MEET THE AUTHORS

Thomas Dujenski - Director, Risk & Regulatory Compliance

Richard Toledo - Director, Risk & Regulatory Compliance

John Henrie - Senior Manager, Risk & Regulatory Compliance

Yakut Akman - Risk & Regulatory Compliance Expert

Hollis Hart - Advisory Board Member