SIG University Certified Third-Party Risk Management Professional (C3PRMP) program graduate Anna Sgro shares how adding procurement roles into third-party risk management systems can be a very effective contribution to your team.
Across many organizations, there is an outstanding need to baseline what, if any, activities are taking place to manage third-party due diligence proactively. From my specific experience, Procurement's role is only sometimes well established and often has limited involvement in third-party risk management. The lack of engagement with the Procurement team introduces unnecessary risk and exposure for an organization.
Incorporating Procurement in third-party risk management and analysis will increase visibility, broaden awareness, and reduce risk by ensuring consistent sourcing, contracting controls, management, and monitoring processes. The standard practice for most Procurement teams includes evaluating new third parties, facilitating the sourcing and contract negotiations, and primarily being responsible for ensuring appropriate terms are in place. However, without a clearly defined path of communication and standardized processes, there's still potential for the organization to be exposed to unknown risks when bringing on a new critical third.
Anna Sgro, Procurement Category Manager of IT, Maxar
SIG University Certified Third-Party Risk Management Professional (C3PRMP) program graduate MJ Ellis shares a unique perspective on the fundamentals of effective third-party risk management through the panes of Johari's Window.
SIG University Certified Third-Party Risk Management Professional (C3PRMP) program graduate Dallin Ingalls shares the inherent value that is associated with a strong third-party risk management framework.
Dallin Ingalls, Engagement Manager for Supplier Risk Management, Zions Bancorporation
SIG University Certified Third-Party Risk Management Professional (C3PRMP) program graduate Nathan Coffet discusses the process of updating a Third-Party Risk Management program and the benefits it can have.
Large fast growing multinational companies involving multiple mergers & acquisitions will often have many disparate processes in place to manage Third-Party Risk. There may be programs developed by individual group companies or parts of the group to meet general procurement needs. Corporate functions such as Privacy, Information Security, Corporate Social Responsibility, or Anti-Corruption may have developed customized programs to meet regulatory requirements or address audit findings. Other programs may have been driven by the need to respond to vulnerabilities arising from macroeconomic events: systemic risks in the financial market; or the impact of Covid on the viability of cross-border supply lines. The multiple languages and cultures add a layer of complexity.
A root and branch review may enable the business to simplify processes, strip out unnecessary costs and duplication and ensure that the key risks are appropriately overseen proportionately. The approach must be focused on the return on investment to make it easier to justify and obtain necessary resourcing.
But where to start?
It is tempting to jump in and start solving the problem before it is well understood. But do not rush.
First - Remember to Reinvent the Wheel.
Nathan Coffey, Senior Vice President of Privacy & Compliance, Teleperformance
SIG University Certified Third-Party Risk Management Professional (C3PRMP) program graduate Mitchell Gustafson describes why becoming familiar with third-party risk management is so crucial for your business team.
All companies rely on a third party, if not multiple. Therefore, it is critical to pick the right ones. Choosing a third party aligned with your company’s third-party risk framework and understanding your company’s overall objective will make your organization more robust and competitive in the long run. I will begin by defining what a third-party is and then shed light on these topics: the main drivers of third-party risk management, the steps of third-party lifecycle management, and why third-party risk is often overlooked.
A third party is a business relationship between your company and another entity that is not your customer, including an affiliate company. When we think about third parties, we are usually thinking about vendors. Other examples can be service providers or outsourcers. In this Global environment, corporations are engaging with countless third-party’s to complete their business needs. Unfortunately, with every third-party arrangement comes an ever-growing scope of risk. As more and more companies begin to rely on third-party relationships, effective risk management, due diligence, and continuous monitoring need to grow with it.
Mitchell Gustafson, Third Party Risk Analyst, NationsBenefits
SIG University Certified Third-Party Risk Management Professional (C3PRMP) program graduate Jai Chinnakonda shares why every organization should adopt integrated third-party risk governance and management into their team structure.
Organizations increasingly depend on third-party service providers of varying sizes, including start-ups, to meet the digital age challenges of technological innovation and heightened competition. In a quest to succeed, organizations involved in digital transformation initiatives partner with more innovative start-ups, thereby increasing third-party risk. There is a progressive shift from a traditional 'cost' focus to a 'shared risk' and 'value-driven partnership.
This is also a growing reflection of organizational recognition that third parties can create strategic win-win opportunities. These new-age partnerships require a different approach to managing third-party risks. Organizations that can continuously monitor and take on calculated risks with their engagement with third parties are the ones that will be able to Stay Ahead. This article reflects on how technology can help support a new Integrated third-party governance and risk management approach.
Traditional Third-Party Risk Management Approach – the challenges
Traditionally, organizations had relied on total upfront due diligence for risk mitigation. This approach attempts to identify potential third-party risks upfront before contracting, resulting in longer onboarding time. Typically, this involves sharing due-diligence questionnaires and collating responses from third parties. This only provides a point-in-time assessment – a highly ineffective approach prone to failures.
Jai Chinnakonda, Co-founder of ENGAIZ, ENGAIZ Inc.
SIG University Certified Third-Party Risk Management Professional (C3PRMP) program graduate Kyle Smith discusses the benefits of a strong third-party risk management team and what it can do for your organization.
SIG University Certified Third-Party Risk Management Professional (C3PRMP) program graduate Jonathan Purdon discusses the vital aspects to add to your risk management framework and the best practices for creating a risk culture.
Jonathan Purdon, Sr. Business Analyst, ATB Financial
SIG University Certified Third-Party Risk Management Professional (C3PRMP) program graduate Noelia Valentina Novoa Pena discusses the value of Third-Party relationship management and how it can help take your team to the next level.
_23.png?WZrq_ThkrjccgpYdz90qe7aOTdHU_p9B= "The Bain of The Unkown")
_17.png?v3BvIwCfwdonr63KqzoCY_z9Q3v0__ko= "The Inherent Value of Third-Party Risk")
_12.png?2vS0bmCwSj8SLzuCf3BBXuL02lPek7oX= "Updating A Third-Party Risk Management Program")
_10.png?hLH_XXP67tGbeF09efvZPsR3NOfrIB_n= "Becoming Familiar with Third-Party Risk")
_8.png?UxAo9Smcy7DJ6AEO7lB6ZtzsAsnvEJbm= "Why organizations need to adopt an Integrated Third-Party Governance and Risk Management approach?")
 (1)_4.png?woiBeOtFRNODFvb2a722jfSCES2aW6OJ= "Expanding Your Own Third-Party Risk Team")
_2.png?A5GbEYxeczjGF6x3izgE2sDUKILzFzrM= "Crucial Aspects for Building your Third-Party Risk Team")
 (1)_1.png?WibR8u0RVBTx82ZA0kWIGYoLET5qFckU= "Establishing a Third-Party Risk Management Program")
Implementing Procurement's Role in Third-Party Risk Management
SIG University Certified Third-Party Risk Management Professional (C3PRMP) program graduate Anna Sgro shares how adding procurement roles into third-party risk management systems can be a very effective contribution to your team.
Across many organizations, there is an outstanding need to baseline what, if any, activities are taking place to manage third-party due diligence proactively. From my specific experience, Procurement's role is only sometimes well established and often has limited involvement in third-party risk management. The lack of engagement with the Procurement team introduces unnecessary risk and exposure for an organization.
Incorporating Procurement in third-party risk management and analysis will increase visibility, broaden awareness, and reduce risk by ensuring consistent sourcing, contracting controls, management, and monitoring processes. The standard practice for most Procurement teams includes evaluating new third parties, facilitating the sourcing and contract negotiations, and primarily being responsible for ensuring appropriate terms are in place. However, without a clearly defined path of communication and standardized processes, there's still potential for the organization to be exposed to unknown risks when bringing on a new critical third.