Revamping Third-Party Risk Management in 2021: Part II

Last week, when we revealed our initial set of predictions for Third-Party Risk Management in 2021, we acknowledged the impact of Covid-19 on global supply chains. Unfortunately, 2020 isn’t done teaching us lessons about the importance of TPRM, as the fallout from the SolarWinds breach continues to come to light.

If one thing is clear for the coming year, it’s that your organization will likely be more focused on getting ahead of vendor risk than ever before. Here are our final four predictions to help you lean into the challenge.

#5. Vendor Risk Evaluations Will Get Faster

The supply chain disruptions of 2020 emphasized not only the need for agility in sourcing new vendors, but also the importance of evaluating risk as part of the sourcing process. Unfortunately, many organizations have traditionally found these two things to be at odds. It’s no wonder the EY Global TPRM Survey 2019–20 revealed that half of respondents don’t have an expedited process for pre-contract risk assessments.

The need for speed will still be strong in 2021, so the TPRM market will accelerate toward the network marketplace model. Under the network model, members can quickly search libraries of prospective vendors, see risk scores, and view completed risk assessments. Other aspects of the network model include:

• A standards-based approach that compares all vendors against the same criteria
• Real-time cyber, business and financial monitoring insights that augment results from periodic vendor assessments
• Flexibility to request assessments for specialized risk concerns
• Clear reporting and analytics to measure risk and compliance
• Workflow management to tie everything together

The best networks are backed by experienced managed services teams who handle vendor onboarding, assessment, management and reporting on behalf of their customers.

#6. TPRM Programs Will Extend Beyond the Third Party

Consider this scenario: Your company outsources manufacturing to a vendor whose parts supplier is in a location with a stay-at-home order, and the supplier’s products aren’t considered to be “essential.” Your vendor needs to quickly find an alternative, or you won’t be able to deliver to your customers.

Just about all supply chains have more than one “link.” If your risk evaluations only consider your organization’s immediate circle of vendors, then your visibility into supply chain threats is foggy at best.

And you’re also not alone. Our 2020 study, The Third Rail of Security & Compliance, found that 79% of respondents didn’t consider 4^th party risk. Furthermore, the EY study referenced above showed that 31% of respondents rely on contractual terms alone to enforce Nth party problems. If one domino falls, then they all go down.

This is all about visibility. Nth party mapping can discover potential deficiencies deep within the third-party landscape. This will become more prominent in 2021, as companies leverage operational resilience measures to predict potential disruptions before they become a reality.