Enabling 360° Intelligence of Third-Party Relationships
The Organization: an Interconnected Web of Relationships
No man is an island, entire of itself; Every man is a piece of the continent, a part of the main.
English Poet John Donne’s Devotions Upon Emergent Conditions (1624) found in the section Meditation XVII.
Substitute ‘man’ with ‘organization’ and seventeenth-century English poet John Donne could be describing the post-modern twenty-first century organization: no organization is an island unto itself, every organization is a piece of the broader whole.
The structure and reality of business today has changed. Traditional brick-and-mortar business is a thing of the past; physical buildings and conventional employees no longer define the organization. Instead, the modern organization is an interconnected web of relationships, interactions, and transactions that extend far beyond traditional business boundaries and nest themselves in layers of relationship complexity. Even the smallest organization can have dozens of relationships that they depend on for goods, services, processes, and transactions. In large organizations, this can expand to tens of thousands of third-party relationships with suppliers, vendors, partners, and service providers.
With businesses increasingly relying on a complex network of third-party relationships to thrive, the governance, risk management, and compliance (GRC) of third-party relationships is critical. Without effective governance of the extended enterprise, organizations will fail to manage uncertainty, avoid disruptions, act with integrity, and achieve business objectives.
In a dynamic risk environment, resiliency requires agility and the ability to navigate uncertainty in business relationships. Effectively mitigating the exposure of potentially disruptive events requires real-time and comprehensive risk intelligence across risk domains with insights to both assess the current and future risk landscape and drive sagacious action.
The Inevitability of Failure: Fragmented Views of Third-Party Risk
Too often, organizations struggle to adequately govern their third-party relationships because of their reliance on outdated practices with limited to know risk intelligence. Recent technological advances in automation, natural language processing, machine learning, and data science enable organizations to be more effective and do more with fewer resources. Unfortunately, too many organizations have failed to seize the opportunity to evolve beyond expensive and inefficient legacy solutions.
Failure in third-party risk management comes about when organizations rely on outdated risk practices with limited to no risk intelligence, including:
- Silos of third-party oversight. Silos of oversight occur when an organization allows different business functions to conduct third-party oversight without coordination, collaboration, and an agile information and intelligence architecture. The risk posed by a third party for one business function may seem immaterial but is significant when factored into multiple risk exposures across all the business functions monitoring other risks of the same third-party. Without a single pane of risk intelligence visibility into the risk in their third-party relationships, silos leave the organization blind to risk exposures that are material when aggregated introducing more risk.
- Limited resources to handle growing risk and regulatory concerns. Organizations are facing a barrage of increasing regulatory requirements and an ever-expanding risk landscape. While risk functions are operating with limited budgets and human teams, they need to do more with less. Truly effective continuous risk intelligence monitoring of today’s dynamic and ever-expanding risk landscape is beyond human capabilities alone and requires Cognitive GRC technologies that leverage artificial intelligence such as natural language processing, machine learning, predictive analytics, and robotic process automation.
- Overreliance on manual processes. When organizations govern third-party relationships in a maze of documents, spreadsheets, emails, and file shares, it is easy for risks to be missed amidst the extensive volume of data and lack of integrated risk intelligence content. In addition, when things go wrong, these manual processes neither support agility nor a robust feedback loop to improve processes going forward.
- Limited view of risk vectors. Organizations often rely solely on third-party financial and cyber risk management and suffer from risk exposure in domains such as compliance, operations, ESG, location and Nth party risk exposure. To fully understand the complete risk picture, an organization needs to have full-spectrum risk coverage of risk intelligence content.
- Scattered third-party risk solutions. When different parts of the organization use different third-party risk solutions, silos of risk data and intelligence are created that are difficult to assimilate, thus making it difficult to maintain, aggregate and provide comprehensive, accurate, and current third-party analysis. The resulting redundancies and inefficiencies make organizations less agile and impact the effectiveness of third-party risk programs.
- Overreliance on Periodic Assessments. For many organizations, third-party risk analysis occurs primarily during the onboarding process at the onset of the business relationship with only periodic re-assessment of risk over the length of the engagement. This approach fails to keep organizations informed in a timely manner when the risk exposure changes between assessments. Without a continuous source of real-time risk intelligence feeds, the organization lacks the ongoing situational awareness necessary for proactive risk mitigation.
- Silos of risk intelligence services overwhelm risk teams. Risk intelligence has the potential to overwhelm organizations. Information feeds from various sources such as legal, regulatory updates, newsletters, websites, emails, journals, blogs, tweets, and content aggregators can drown the risk team as they struggle to monitor a growing array of regulations, legislation, corporate ratings, geopolitical risk, and enforcement actions. Risk intelligence that requires weeding through an exorbitant volume of notifications that includes noise and false positives to identify relevant risks only compounds the problem. One needs an intelligent system that can deliver accurate and actionable insights and remove the noise.
When the organization approaches third party risk management in scattered silos that do not collaborate with each other, there is no possibility to be intelligent about third party performance, risk management, compliance, and impact on the organization and ESG. Without a coordinated third-party risk intelligence strategy, the organization and its various departments never see the big picture.
The bottom line: The modern business is dependent on third-party relationships and requires real-time and continuous awareness of its current and future risk landscape. A manual and point-in-time approach to third-party risk intelligence compounds the problem and can lead to elevated risk exposure and blind spots. It is time for organizations to step back and move from legacy practices, defined by manual processes, periodic assessments, and silos of risk intelligence content to a third-party risk intelligence solution that includes integrated full-spectrum real-time feeds of situational awareness of the organization’s extended enterprise.
GRC 20/20 has the following upcoming Third-Party Risk Management by Design Workshops in the next few months that dives deep into this topic of a holistic view of third-party risk . . .
Chicago: March 30 @ 12:00 pm – 6:00 pm CDT
New York: April 25 @ 12:00 pm – 6:00 pm EDT
San Francisco: May 2 @ 12:00 pm – 6:00 pm PDT
Houston: May 4 @ 12:00 pm – 6:00 pm CDT