The importance of Third-Party Risk Management - session 1

6. Unaddressed risk can be unpredictable

If a third party can't give an appropriate oversight of their proper safeguards and controls, the Organization can be exposed to increased fiscal, operational & contractual, regulatory or reputation risk.

The most recent and famous example was the COVID 19 vaccine contract which the EU negotiated with one of the vaccine manufacturers. The "at best effort" clause created a higher risk for the EU to obtain their contractual target, i.e., to get the EU population vaccinated in the shortest delay.  Broken processes, not taking effective action when issues arise, not monitoring remediation activities can be more costly than addressing the risk up front.

7. What is your Organization putting at risk?

The following risk factors can have an important impact on the success of your project or Organization:

• Strategic Risk: Risk of unsuitable sourcing decisions by the Organization due to a lack of third-party alignment with the Company's business strategies and objectives.
• Contractual Risk: Risk that the Organization does not receive products and/or services in line with its expectations due to incomplete or insufficient third-party contract provisions, or a third party’s inability to meet contract terms and conditions.
• Discontinuity of service/product risk: Risk of the Organization’s operations being disrupted by the ineffectiveness of a third party’s business continuity program, or by the third party’s inability to provide services to the Organization for an extended period of time. Risk when a third party decides to stop the production of a certain product or the delivery of a certain services.
• Risk of Reputation Damage: Risk of brand damage to the Organization due to a third party’s inability to meet the Organization’s expectations and/or compliance. E.g., whereas a company could have a strong focus on its sustainability reputation, a huge pollution incident of their third party can hurt the public opinion about the Organization's brand.
• Financial Viability Risk: Risk of disruption to the Organization's operations due to a third party no longer being able to provide products/services as it’s unable to generate profit or maintain necessary capital for supporting its ongoing operations. Risk elements as size of the third-party company, growth rates, profitability, liquidity, capital structure, access to capital, market position, geographic territory and depth of the management needs to be taken into account.
• Credit Risk: Risk of a financial loss to the Organization that arises when credit exposure is caused by a third party holding, settling, or issuing a guarantee to the Company; or creating a liability for the Organization when the third party is not adequately managed.
• Compliance/Legal Risk: Risk that the Organization is not in compliance with laws, ethical standards, or its own policies/standards/procedures because a third party does not have adequate compliance management controls over its products/services/tools.
• Information Security Risk: Risk of inappropriate disclosure, corruption, or destruction of the Organization’s confidential information due to a third party’s failure to provide appropriate security and privacy controls over the institution's information.
• Transactional/Operational Risk: Risk of a financial loss to the Organization and/or an adverse impact to the Organization’s product/service delivery due to inadequacies in a third party’s internal processes/people/tools and/or other third-party issues, e.g., no back to back terms and conditions with the third party subcontractor.

• Geopolitical Risk: Risk of disruption to the Organization’s operations due to economic, social, and political conditions and events in a country that may adversely affect a third party’s operations or viability.

   

Examples of regulatory laws:

• U.K. Data Protection Act
• EU General Data Protection Regulation (GDPR)
• US International Safe Harbor Privacy Principles
• Consumer protection agencies —digital rights
• Guides: European Union Agency for Network and Information Security (ENISA)
• Industry: Payment Card Industry (PCI) Security Standards Council guidance

8. Risk Mitigation Plan

Despite risk functions identify and prioritize the potential risk categories, they don’t have any influence on the effective arising of the risk.

So you may ask yourself: “What to do if your vendor goes bankrupt? What are the actions to be taken when the identified risk occurs?”

Risk Management measures are divided into two groups: preventive and repressive measures. In the preventive measures there are again two options. The risk leader can find ways to reduce or even eliminate the risk. Second the risk function can try to mitigate the impact on the contractual objectives.

Repressive risk management measures are implemented after the risk has occurred and then only measures are possible to reduce the magnitude of the impact or restore the initial situation completely. The reconstruction of a burned-down building, using the funds of the insurance company, is in fact a repressive risk management measure.

The risk function consults with the contract owner about the risks that the risk leader has identified and the appropriate measures that he/she will implement and how the communication with the third party about the risks and the measures will take place. The decision to waive a measure is also an option. This depends on the risk appetite of the Organization in general and the cost-benefit balance. The contract owner then accepts the risk. All decisions are recorded for approval. The contract owner shall in good cooperation support the risk function in the final decision of the action.

9. Who takes the role as third party risk function in your Organization?

Risk management is often seen as the role of auditors and lawyers only. However, in early precontractual discussions these functions are rarely invited at the discussion table with the third-party. Therefore we don’t limit the role of the risk function in this report only to the compliancy officers of your Organization. We think that any representative of your Organization who takes a seat at the table together with a third-party, needs to be aware as from the beginning of the potential risks of that third-party.

The following roles often assume the risk function duties in a third-party discussion:

• Sourcing & Vendor Manager (SVM)
• Contract Manager
• Legal Counsel & Auditors
• Service Manager
• IT Architect
• IT Business Partners
• Business Managers
• External Auditors

Now you know what kind of contingencies can jeopardize your success and who needs to create a risk awareness, continue to read the next blogpost and learn how to improve your Organization’s TPRM capabilities.