How to Build a Single Source of Truth for Third-Party Vendor and Supplier Risk Information

Research from the 2023 Third-Party Risk Management Study shows two very interesting trends. First, more departments than ever are involved in third-party risk management (TPRM), with the largest year-over-year involvement growth coming from the Information Security, Risk Management and Compliance/Audit teams. And second, although Information Security teams own the TPRM program in 71% of companies, it’s the Procurement team that generally owns the third-party relationship.

One team owns the TPRM program, but another owns the vendor/supplier relationship. Many teams have a hand in TPRM, and those teams all have their own third-party risk needs. Inevitably, this multi-departmental approach to TPRM could lead to inadvertent silos, miscommunication or downright lack of critical information sharing.

How can organizations bring departments together under a lingua franca of third-party risk management? It starts with building a single source of truth as it relates to third-party vendor and supplier information.

This post examines the challenges and consequences of a disjointed approach to managing third parties and recommends ten best practices to unite teams under a single source of truth.

Challenges of a Multi-Departmental Approach to Third-Party Risk Management

A multi-departmental approach to managing third-party vendor and supplier risk is not inherently wrong; it just takes an organizational commitment to coordinate functions. If not done consistently, though, different departments running in different directions with regard to their third-party risk assessments and analysis can have several negative consequences.

• Fragmented departmental requirements can limit the effectiveness of vendor/supplier due diligence.
• Different tools may produce inconsistent reporting on metrics that don’t align with overall organizational goals.
• Risk decision-making is scattered – there is no one person or team looking at the big picture of third-party risk.

Building a single source of truth for third-party vendor and supplier risk management is crucial for organizations looking to streamline their risk assessment processes and ensure data accuracy and consistency.

How to Build a Single Source of Truth for Third-Party Risk

A single source of truth serves as a centralized repository of consistent and reliable information that can be accessed and relied upon by various stakeholders across the organization. Here are ten steps to help you establish single source of truth for vendor and supplier risk:

1. Define Organizational Objectives and Key Metrics

Begin by understanding what specific risks the organization needs to assess and manage, and what information is critical for decision-making. For example, what are the key risk indicators (KRIs) that signal potential problems in your third-party vendor and supplier base? As part of this process, conduct a comprehensive review of enterprise risk metrics – including those across multiple stakeholder departments.

2. Identify Key Enterprise Stakeholders

Based on the enterprise risk metrics defined in step 1, determine who will be using the single source of truth. This could include procurement teams, risk management, compliance officers, legal teams, and other relevant departments beyond IT security. As you identify key stakeholders, validate that the KRIs chosen in step 1 are accurate, and adjust them accordingly.

3. Conduct an Audit to Understand Current Data Sources

Once you understand what the organization should be monitoring and who should be involved, the next logical step is to find out where existing third-party risk data is coming from. Common sources of third-party risk data typically deliver:

• Status on internal controls over key business processes
• Firmographics and company insights
• Cyber signals from security monitoring tools
• Business/Operational updates
• Reputational information
• Financial or credit scores for financial health
• Environmental, social and governance (ESG) status
• Compliance or sanctions insights

Once you have audited data sources you can determine possible data overlaps or identify gaps in information to fill.

4. Centralize Third-Party Risk Data in a Single Technology Platform

Your organization will achieve maximum risk management benefit if all necessary third-party risk data is centralized and visible to all relevant stakeholders. Therefore, choose a single technology platform or software solution that can serve as the backbone for your single source of truth. Consider options that offer integration capabilities, data analytics tools and stakeholder-specific reporting. Centralizing data has an additional benefit of fostering collaboration among stakeholders.