SIG University Certified Sourcing Professional (CSP) program graduate Heather Frazer discusses how TCO is a great tool that will help capture the entire potential for cost savings and risk and how it is increasingly important for procurement organizations to secure reliable data.
Heather Frazer, Procurement Specialist, Blue Cross Blue Shield of Tennessee
SIG University Certified Third-Party Risk Management Professional (C3PRMP) program graduate Anna Sgro shares how adding procurement roles into third-party risk management systems can be a very effective contribution to your team.
Across many organizations, there is an outstanding need to baseline what, if any, activities are taking place to manage third-party due diligence proactively. From my specific experience, Procurement's role is only sometimes well established and often has limited involvement in third-party risk management. The lack of engagement with the Procurement team introduces unnecessary risk and exposure for an organization.
Incorporating Procurement in third-party risk management and analysis will increase visibility, broaden awareness, and reduce risk by ensuring consistent sourcing, contracting controls, management, and monitoring processes. The standard practice for most Procurement teams includes evaluating new third parties, facilitating the sourcing and contract negotiations, and primarily being responsible for ensuring appropriate terms are in place. However, without a clearly defined path of communication and standardized processes, there's still potential for the organization to be exposed to unknown risks when bringing on a new critical third.
Anna Sgro, Procurement Category Manager of IT, Maxar
SIG University Certified Third-Party Risk Management Professional (C3PRMP) program graduate Lokesh Bhatnagar provides descriptions to determine which 4th parties are material, and how to incorporate them into the post-contract phase in the lifecycle as well as effective risk monitoring and oversight.
Introduction
In the increasingly interconnected global economy, organizations depend on third-party vendors and service providers to maintain efficient, competitive supply chains. Effective third-party risk management (TPRM) is vital to safeguard organizations against financial, operational, and reputational damage. However, many TPRM strategies often overlook the risks posed by fourth-party subcontractors, particularly those that are material to the organization.
Understanding Materiality in Fourth-Party Risk
Before delving into the management of fourth-party risk, it is essential to grasp the concept of materiality. A material subcontractor is one whose failure or poor performance could significantly impact an organization's operations, reputation, or regulatory compliance. Factors contributing to a subcontractor's materiality include:
Sensitive data handling: Assess the risk associated with subcontractors managing confidential information, as they pose a higher risk of data breaches or misuse.
Impact on third-party service delivery: Evaluate how a subcontractor's performance could impair a third party's ability to deliver contracted products or services, possibly leading to operational disruptions.
Lokesh Bhatnagar, Senior Service Delivery Leader, American Express
"Without data, you're just another person with an opinion."
Edwards Deming, Statistician
Linda Tuck Chapman, instructor and course designer at SIG University, states that Third-Party Risk Management is a team sport. A team consists of lots of different people with lots of different opinions. These opinions might be based on the various roles and result in other goals they have. They all strive for the same overall target, a managed and their company acceptable risk, but might have a different focus. The risk analyst might be especially eager to analyze the risk deeply, and the buyer might want to focus on a fast decision to close a deal.
So, what can help turn their opinions into a decision? Or help, whoever has the right and the responsibility, help them make a decision? Of course, the answer is a high-quality database that turns opinions into facts. It is essential to ensure a high-quality database, especially in a worldwide program with different risk areas, teams, and global regulatory requirements. High quality, in that case, means (at least) that the data is accurate, that it contains all required data fields, that it has a clear structure, and that it is accessible to all relevant people while still restricting the possibility of editing the database itself (meaning strict controls).
Mona Josten, Senior Consultant, Deloitte Deutschland
In what was traditionally a siloed function, separate from overall executive and organizational strategy, procurement professionals have more recently become integral to company operations and resilience. This prominence grew during the COVID pandemic, which broke down barriers between departments and raised attention to the importance of Chief Procurement Officers (CPOs) and other procurement personnel, and the work they do.
The Power of Procurement
The procurement team is at the interface between the enterprise and the extended enterprise: the organization and its suppliers. Procurement professionals are in the position to understand the risks and the wider ecosystems their suppliers operate in. They, like no other function, can make predictive connections and be able to quickly identify risks specific to one supplier or those endemic to the wider ecosystem, and quickly pivot alongside the business accordingly. And it’s not just risk, but opportunity and innovation for the enterprise, such as identifying new products, materials, capabilities and offerings.
With this greater inclusion of procurement professionals into organizational strategy, CPOs and similar roles need to begin to reframe how the function can best serve the organization, and how other departments can serve them. One key to this new way of thinking is framing procurement around holistic risk management, particularly when it comes to managing third parties, suppliers and the supply chain.
Best Practices for Taking a Holistic Approach to Procurement
While not everything in this shift can be implemented immediately, there are general aspects of agility that should be on procurement’s agenda, including:
SIG University Certified Third-Party Risk Management Professional (C3PRMP) program graduate Kyle Brown discusses the value proposition and responsibilities for the key players in an effectivethird-party risk management program.
Each business unit owns the risks associated with the contracts they decide to enter into. This is a fundamental principle built into third-party risk management (TRPM) programs. In large organizations, the program's success is highly dependent upon each Business Unit fulfilling their responsibilities.
The Business Unit Structure for Risk Management Success
The business unit needs to ensure they have a suitable organizational structure and resources to fulfill their third-party risk management program responsibilities. This includes having team members trained in specific competencies and adequate capacity based on the level of risk associated with the business unit's third parties and sufficient capacity based on the level of risk associated with the business unit's third parties.
Once the contract is set, the business unit is responsible for the activities and tasks related to owning the relationship ( “relationship management”), including communication, contract, performance, and risk management. Team Members who reside within a business unit who perform relationship management activities comprise the largest internal population of team members who should manage risk due diligence activities with third parties.
SIG University Certified Third-Party Risk Management Professional (C3PRMP) program graduate Andrea Solano discusses how taking the C3PRMP program helped her to implement the framework for her team to operate as an optimal risk management and risk mitigation function across her department and enterprise-wide.
There are different types of workstreams and specializations that have been around a long time. However, the discipline of Third-Party Risk Management is something that is in the very beginning stages of inception. Currently, it is evolving into a discipline that many organizations shall be implementing as a standard operating function in the Silicon Valley business sector I work at. Working at Silicon Valley, the term Third-Party Risk management is still somewhat foreign and not understood as a critical and vital risk management function.
Third-Party Risk Management Function
The key role that I fulfill within the Third-Party Risk Management life cycle is in the due diligence process, which is the internal audit function that serves as a 2.5 – 3rd line of defense within my organization’s Risk Management Function. The SIG University Third-Party Risk Management training that I have taken throughout these past ten weeks has been highly instrumental for me. It will help create, build-out, and develop an internal audit framework that will be customized to meet the needs of this brand-new Third-Party Risk Management function within my organization.
Andrea Solano, Global Security 3rd Party/Outsourced Audit Manager, Facebook
The concept of sustainable sourcing, also known as green purchasing or social sourcing, is nothing new. Sustainable sourcing is impacting nearly every area of corporate business and the consumer’s mindset. Everything from sourcing materials, talent attraction and consumer purchasing habits is changing because of sustainable sourcing growth. However, the term gets thrown around in the procurement industry quite often and is often misunderstood or misused. So, here’s a guide with all the basics you need to know about sustainable sourcing.
WHAT IS SUSTAINABLE SOURCING
First and foremost, we have to define the term. Sustainable sourcing is the integration of social, ethical and environmental performance factors into the process of selecting suppliers. It includes purchasing sustainably preferable products and services (products made from recycled or remanufactured materials), as well as green purchasing guidelines that might pertain to certain products or commodities.
Procurement is a business function that offers so much in the way of value. However, its not always easy to showcase the full spectrum of what procurement provides to other teams or get the necessary buy-in from sponsors or stakeholders to support procurement activities. In fact, one of the common pain points for procurement practitioners is the ability to align finance.
Finance is a critical business function. So much of what guides operations is based on the bottom line and therefore it is absolutely essential that procurement align with finance. Without this collaboration, procurement teams will struggle to gain credibility within an organization and will be less able to contribute to the overall success of the business. In order for procurement to truly be successful, it needs to align with finance. Here are some tips for helping achieve alignment between finance and procurement.
Develop a reporting structure that promotes collaboration
Reporting is essential for keeping different departments aligned. It’s only logical that the department in charge of managing money and the team that handles buying should coordinate. To really make the most of your collaborative efforts, try syncing on reporting structure to increase adoption. Ideally, procurement would actually fall under the purview of finance wherein the CPO reports directly to the CFO to increase that alignment. Benefits include:
_27.png?rBRb7z6G1PLmvD34agWdkpVXRM2CNd5I= "Implementing Procurement's Role in Third-Party Risk Management")
 (1)_0.png?aw0gQxb5DHZwQ9qZQavJcHzT919vuq5r= "A Comprehensive Approach to Managing Fourth-Party Risks in Third-Party Risk Management Strategies")
 (1)_1.png?e_xTmpT_7XhsufOyj2t6IAvrlMvyGnbH= "The Meaning of a High-Quality Database in a Team Sport called Third Party Risk Management")
 (1)_1.png?WibR8u0RVBTx82ZA0kWIGYoLET5qFckU= "Establishing a Third-Party Risk Management Program")
 (1).png "It’s Time to Take a Holistic Approach to Managing Procurement Risks")
 (1).png "Business Unit’s Role in Elevating Third-Party Risk Management Capabilities")
 (1).png "Implementing the Third-Party Risk Management Framework into a New Third-Party Audit Program")
 (1).png "How to Align Procurement with Finance")
Maximizing the Potential for Cost-Savings and Risk
SIG University Certified Sourcing Professional (CSP) program graduate Heather Frazer discusses how TCO is a great tool that will help capture the entire potential for cost savings and risk and how it is increasingly important for procurement organizations to secure reliable data.