Managing third-party risk: Dominant trends

One in five organizations has faced significant risk exposure due to a third party in the last 18 months. Of those who shared loss data, 25% said that the loss impact was greater than $10 million.

As companies outsource their processes or services, they expose themselves to a range of third-party risks, including data security risks, business disruptions, legal liabilities, corruption and bribery risks, and compliance risks – all of which have a major impact on profits and brand value.

Fourth-party risk management is also emerging as a key area of focus, with organizations being held responsible not just for the actions of their immediate third parties, but also for the actions of their third parties’ vendors and suppliers. Adding further impetus are regulations from authorities such as the Office of the Comptroller of the Currency (OCC) and the Consumer Financial Protection Bureau (CFPB), as well as mandates such as the UK Bribery Act and the Health Insurance Portability and Accountability Act (HIPAA), which stipulate stringent requirements for third-party governance.

To find out how organizations are managing their third-party risks in this regulatory climate, MetricStream surveyed professionals from risk management, compliance, legal, supplier management, audit, IT, and other business functions. The survey covered four primary areas: the responsibility for and ownership of third-party risks; the process of third-party risk assessment; the impact of third-party risk incidents and measures taken to resolve issues; and the role of technology in managing third-party risks.

Key parameters for evaluating third-party risk

Key findings

• 21% of respondents reported that their organizations faced risk exposure due to third parties in the last 18 months; of those who shared financial impact data on the losses, 25% said that the loss impact was greater than $10 million
• The top three parameters on which third-party risks are assessed include: data protection, financial viability, maintaining SLAs
• Of the organizations with a dedicated third-party risk management function, 59% indicated that third-party risk management is included within their organizations’ broader enterprise risk management function
• 44% of respondents reported that their organizations don’t have a dedicated third-party risk management function or a centralized third-party information repository
• Nearly half of the respondents (48%) still use office productivity software to manage third-party risks
• 73% of respondents do not track their fourth parties.

“If companies want to build truly beneficial relationships with their vendors or suppliers, they need to be more vigilant – and that means monitoring third parties more frequently based on the associated level of risk, establishing clearly defined roles and processes for third-party governance, and implementing integrated systems that give organizations the risk visibility they need to make informed decisions about their third parties,” said French Caldwell, Chief Evangelist, MetricStream.