Third-Party Risk Management in 2022: What to Expect and How to Respond

5. Increased focus on vendor screening and pre-contract diligence

Third-party risk management programs continue to play catch-up on legacy contracts that have insufficient risk-based clauses and due diligence performed on their risk posture pre-signature. Rather than reactively rush to address deficiencies, 2022 will see a more pragmatic approach to establishing the risk posed by a third party up front, and importantly positioning remediation and resolution as necessary obligations in order to secure a contract.

Readily accessible insights into third party performance through passive cyber scanning, business event correlation, breach events, ESG comparisons, and financial scorings will paint a meaningful picture before even sending a third party assessment and will continue to justify expenditure in the negotiation process. Examine how you are performing pre-contract due diligence, inventory your data sources, and consider how you will close those intelligence gaps.

6. More focus on non-IT security related risk dimensions including ESG, health and safety, diversity and ethics

While ESG and ethics have often been checkbox addendums to contracts (in fact, fewer than half of companies are actively tracking these risks), better availability of datasets and reporting is enabling organizations to hold third parties more accountable in these areas. As renewed consumer and peer interest drives ethical sourcing, executives are increasingly expecting a more robust process with meaningful metrics to demonstrate progress.

Moving into 2022, ethical sourcing will become increasingly embedded in the assessment and review workflow rather than purely being taken at face value. Third parties play a notable role in demonstrating actionable change in company ethics, which will be an increasingly marketable tool. To address this trend in 2022, take a look at how you are assess your third parties. Can your company’s brand value weather a reputational hit if a supplier fails in ethical obligations?

7. Greater emphasis on post contract obligation tracking and enforcement (e.g., KRIs and SLAs)

Complementing our earlier prediction on increased pre-contract due diligence, 2022 will see greater emphasis on post-contract performance. Supplier relationship management over the course of a vendor’s lifecycle has often historically been associated to project teams and business sponsors who are often too busy to consolidate findings and concerns in a centralized location. This results in “tribal knowledge” of third party performance often scattered throughout the business and lost as teams migrate.

2022 will see an increased focus on driving consistency and centralization when it comes to iterative vendor performance management. This will be driven by the advantages it provides, such as effective negotiation tools and levers, as well as resilience/security risk visibility associated to findings. In general, organizations should adapt their third-party risk management programs to address risk at every stage of the vendor’s lifecycle, not just at onboarding or once per year at renewal.

8. Increased openness to using managed service to augment internal teams and enable scale beyond top tier IT vendors

As third-party risk management program expectations evolve with the convergence of multiple audiences and organizational risk criteria to manage, the associated effort increases and subject matter expertise becomes scarcer. New risks mean that information security is no longer the only game in town. However, this expertise is not always readily available in-house, nor are the mechanisms or resources available to capture and adequately document the risks. Consequently, more third-party risk management teams are sensibly identifying their knowledge and resource gaps, and will consider more outsourced services to enrich their programs.

Going into 2022, take an internal skills and resource assessment to determine if outsourcing some of your third-party risk management program will enable your team to accelerate its risk reduction efforts. Prevalent customers, for example, report reducing their manual labor by 50%, accelerating their risk identification by 44% and improving their team productivity by a factor of 3-4 by leveraging managed services.

9. Deeper analysis will be required to map to organizational risk assessment needs

As vendors continue to face the irksome requirement of articulating the same information in different ways, those that have the luxury of refusing will increasingly do so. Instead, third parties will offer pre-completed materials such as ISO or SOC II reports which will put pressure on organizations to perform deeper analysis and mapping to their internal needs.

While this may appear detrimental if it doesn’t align to your third-party risk management program, there is a hidden advantage in that the third party likely has invested proportionately more effort in creating quality responses and artifacts. The challenge into 2022, therefore, will be to translate these more robust materials into the preferred structure to enable a true analysis of controls. Look for solutions that enable automated mappings of risk controls to satisfy multiple requirements.

10. Some organizations will expand their TPRM programs to include 4th- and Nth-party risks

As third-party risk management programs continue to wrestle for control over their third party estates, some organizations are beginning to go beyond third parties by considering the risks posed by their third parties. This evolution will necessitate a shift from a compliance-driven view to a more risk-driven lens.

In 2022 improvements in technology and greater reliance and awareness of the broader supply chain mean it will become the norm to assess upstream 4th parties and at the very least, consider their potential impact if a disruption should occur. Organizations should be prepared to build a relationship map that visually shows interconnections and data flows in their supplier ecosystems.

Prepare Your TPRM Program for 2022

Investigating these top 10 trends will put your TPRM program on a solid footing for 2022 and beyond and ensure you stay agile and ready for what’s next. To get started, register for a free TPRM program maturity assessment. The output of this assessment will prescriptively tell you what steps to take to improve your program. Or contact us for a strategy session today.