Revamping Third-Party Risk Management in 2021: Part I

When we compiled our 2020 third-party risk management predictions, there were no mentions of pandemics, business resilience, supply chain failures, or even social distancing. Our crystal ball failed us.

For sure, 2020 changed how third-party risk management practitioners went about their jobs. And we don’t need a crystal ball to know that the pandemic will continue to impact supply chains over the coming year. If your current TPRM playbook isn’t focused on supply chain resilience, then it may be time to throw it out and write a new one.

Our experts have gathered to make eight predictions to help you get a head start. We’ll start with the first four in this post and then round out the list with Part II next week.

#1. Third-Party Intelligence Will Reveal Risks Throughout the Vendor Lifecycle

2020 saw a litany of supply chain failures triggered by unpredictable events. These incidents shed light on the fact that companies need to understand risk at every stage of the vendor lifecycle – from sourcing to offboarding, and everything in between.

In 2021, third-party risk practitioners will need to expand their visibility by seeking risk intelligence at several key milestones throughout the vendor relationship:

• Sourcing and Selection – Checking a prospective vendor’s reputational and credit histories can reveal whether they meet their financial and customer commitments. This information can also indicate whether they will be able handle sudden shifts in demand and have the financial resilience necessary to weather economic downturns.
• Intake and Onboarding – Bringing on a vendor requires taking an even deeper look at their potential risk. That’s why strong TPRM programs build comprehensive risk profiles that include cybersecurity, legal, sanctions and/or compliance issues for each vendor. The key here is to be proactive and start measuring risk on day 1 of the vendor relationship.
• Prioritization and Scoring – Different types of vendors bring different levels of risk, so effective vendor tiering and categorization can be the secret to building a sustainable TPRM program. Inherent risk metrics can help you not only gauge the likelihood and impact of security and compliance incidents, but also determine the level of due diligence required for each of your vendors.
• Assessment and Monitoring – By conducting internal controls assessments, you can shed light on vendor cybersecurity and governance practices and activate remediations when necessary. But internal assessments tell only half the story. You still need to validate vendor responses, check remediations, and uncover risk between assessments. That’s where continuous risk monitoring can help. Solutions that combine public, private and dark web cyber monitoring with business and financial monitoring will deliver the most complete vendor risk intelligence.
• Reporting and Management – Third-party intelligence is only valuable if you can understand and act on it to reduce risk and strengthen vendor relationships. Effective reporting enables multiple stakeholders to collaborate on reducing exposures and ensuring compliance. It can also provide insights on vendor performance and contract adherence to inform procurement and renewal negotiations. The best TPRM solutions deliver all of this through a single pane of glass.

#2. Vendor Risk Measurement Will Expand Beyond Cybersecurity

There is more to vendor risk than cybersecurity threats, and there are several other risk factors that impact a vendor’s ability to deliver its products and services.

For example, are your vendors financially stable? Do they pay their bills on time? How do they handle operational disruptions from natural disasters and health emergencies? How might their ethics or sustainability violations threaten your organization’s brand or reputation?

For more complete vendor risk analysis, you’ll want to add these classes of risk to your monitoring initiatives in 2021:

• Operational Risk: Leadership changes, restructuring and M&A activity can indicate strategic shifts, while partner/OEM updates can signal price increases and other changes.
• Brand Risk: Product recalls, data breaches, and other incidents can result in negative PR.
• Regulatory and Legal Risk: International sanctions, class action lawsuits, and violations of regulatory standards can cause substantial delays in product and service delivery.
• Financial Risk: Bankruptcy proceedings and missed earnings can lead to restructuring and discontinuation of specific vendor offerings.

A unified TPRM platform can help to normalize, correlate and analyze this monitoring data with results from cybersecurity assessments.