Challenges

The challenges with third-party management will be plentiful and unique to every arrangement.  Opus & Ponemon Institute announced in the results of their 2018 Third-Party Data Risk Study that “59% of Companies Experienced a Third-Party Data Breach, Yet Only 16% Say They Effectively Mitigate Third-Party Risks”

The saying goes, “Nothing worth having comes easy” and it isn’t any different with risk management. Otherwise, would only 16% of businesses say they effectively manage third-party risks? That’s not to say that it is an exceedingly difficult process, but we often encounter businesses with a lot of uncertainty around how to implement an effective risk management plan for their third parties. When internal resources are already stretched, many foolishly take the stance of expecting the third party to be able to manage themselves (and take responsibility when something goes wrong).

The primary challenge usually comes from a lack of support in leadership. Upper management needs to see the value in risk management and approve budgets so team members can establish an effective risk management plan. If anything, the fact that 59% of companies experienced a breach should motivate decision-makers to act.

Approaching Third-Party Risks

 Whether you’re exploring the possibility of using third parties and want to be prepared or just want to review your current approach, here are some key steps in approaching third-party risks.

1.Assign Responsibility

Before you can begin assessing risks and planning mitigation, you need to determine who will champion your efforts. This will typically be risk management or compliance staff, but if you don’t have dedicated employees for these activities you’ll need to select knowledgeable and relevant staff across departments.

2.Pre-Screen Third Parties

Most companies perform background checks and drug tests on new employees to ensure the company will be investing time and resources into a worthwhile candidate; why should a third party differ from this thought process? When selecting a supplier, vendor, or another third party for your organization, make sure you complete a thorough risk assessment to ensure they are the right fit for you. Depending on the industry, this could be asking for proof of security certifications, a record of regulatory compliance, the testimony of other partners, etc.  Conducting due diligence on all potential third parties is crucial prior to entering into contracts or relationships.

3.Identify Potential Third-Party Risks

As we did with the examples given in paragraph two, describe scenarios where risks can arise from your partnership with a third party. Ask who has access to customer data. Is a vendor located in a high crime area, and could this cause interruption to business? How is your information protected by third parties? A risk assessment will identify all areas of concern.

Many third-party relationships will necessitate sending and receiving information and access to private networks and systems. Identifying these risks is the first step of your risk management plan and key to having healthy, lasting relationships with third parties.

4.Contract Negotiation

Management and legal counsel should review contracts prior to signing and actively participate in negotiations. Incorporate your standards from the pre-screening and include any necessary potential risks that you’ve identified. Determine under what circumstance your partnership will continue and what actions (or inactions) will result in termination.

5.Third-Party Monitoring

Once you’ve negotiated terms and settled into a normal business routine, it’s important to conduct regular assessments to ensure your third party is keeping up their end of the agreement. This isn’t to say they’re inherently untrustworthy, but when the prosperity of your company and employees is on the line, you can’t be too safe. It could also be required depending on certain regulations you must adhere to.