In Part One of our blog series on vendor risk management (VRM), we looked at some of the hurdles organizations face when it comes to vendor risk management. One of these challenges was overcoming complacency with your VRM program. VRM should be a growing, evolving part of risk management, and without regular assessment and improvement, it won’t be able to effectively inform and protect your business. In Part Two of this series, we will walk through the critical steps of identifying and profiling vendors and look at the important role vendor profiling plays in identifying vendor risk, strengthening your VRM program, and finding opportunities for improvement.
A VRM program ensures that the use of third-party service providers does not carry an unacceptable risk of business disruption or otherwise have a negative impact on business performance. In order to carry out this responsibility, your program must have processes in place to carefully evaluate vendors before they partner with your organization.
The first step of this process is identifying the need for a third-party service provider. The two most common reasons for choosing an outside service provider are 1) the opportunity cannot be met by in-house employees or 2) it is more cost-effective to outsource. Identifying a specific need (or needs) will help you then establish the type of relationship your organization will have with the vendor.
Before inking a deal with your new vendor, your organization needs to do its due diligence. Proper due diligence requires organizations to identify who within the organization has the authority to determine a service need and who will act as the primary point of contact for inquiries related to the third party.
When selecting a third-party vendor, organizations should consider the vendor’s reputation, experience, history of incidents, and corporate policies and procedures, particularly as they relate to data security and privacy.
When issued as part of the due diligence process, third-party questionnaires can provide valuable insight into a vendor’s security measures and policies. Before determining the questions to ask in the survey, it’s important to consider how this vendor will interact with your data. Will they be collecting, assessing, processing, transmitting, or storing any of your data? If so, your organization will need to evaluate the potential privacy and security risks that may arise if you initiate a relationship with this third party.
As we saw in Part One of this series, the average number of vendors per company is growing, third-party threats are evolving, and regulatory requirements are constantly changing, which means VRM is becoming more and more complex. Therefore, creating a comprehensive risk profile for each vendor is a critical step for protecting your organization. Your vendor risk profiles should answer the following:
Many organizations rely on the use of vendor questionnaires to help them answer these questions and build risk profiles. In addition, regular assessments of your vendors are a critical part of vendor risk management, and completed risk profiles are valuable resources during these assessments.
During the vendor onboarding process, your contract should include expectations and obligations around risk management, such as:
These contract terms should be included in the risk profile, so you can easily review the important details of the contractual relationship that may affect a vendor’s risk score.
You can use these vendor profiles to build a risk tolerance structure, which allows you to determine the level of risk to your organization by measuring the probability or likelihood of risk against the consequence severity. These vendor profiles can help your organization determine whether vendors are low risk or high risk, so you have a system that enables you to prioritize vendor risk appropriately and develop a targeted strategy to address these risks. This ranking system brings a number of significant advantages:
For low-risk vendors, a periodic self-assessment or questionnaire may be a sufficient way of monitoring the security measures of a vendor. However, when it comes to higher-risk vendors, one best practice is to perform regular in-depth, on-site audits of their policies and procedures. You can then leverage your vendor profiles to categorize vendors based on risk and focus your audits on the vendors that need the most attention. Audit expectations should be set by your organization during the contracting process, so your vendors are aware that you have the contractual ability to audit their policies and processes at any point in time and that your requirements may change over time. It is critical that your organization uses its right to audit higher-risk vendors regularly, so that it is fully aware of any changes to their operations, technology, or security measures.
Building a successful VRM program is an ongoing process that constantly cycles through identifying, selecting, evaluating, and monitoring third-party relationships. In the end, organizations must remember that they are ultimately responsible for the security of their data, even when it’s being processed outside their walls. It is incumbent upon each organization to ensure that they are analyzing and mitigating risk at each stage of each vendor relationship. Security and privacy threats are always evolving, and although there is no way to guarantee an incident won’t occur, a VRM program will greatly assist the organization in mitigating the risk and minimizing the impact a possible breach may have.
Focal Point specializes in helping organizations build, assess, improve, and manage their VRM programs. Talk to an expert today and learn more about how we can help.
Subscribe to Focal Point's Risk Rundown below - a once-a-month newsletter with templates, webinars, interesting white papers, and news you may have missed. Thousands of your colleagues and competitors have signed up! You can unsubscribe at any time.