Staying on top of the myriad of risks coming at your organization can be a herculean task, but when combined with risks from third parties it can be overwhelming.
You have some control over your own risks, but much less control over third-party risks, not to mention risks from their third parties (4th, 5th, Nth parties). There’s only so much you can do, but what you can do is strengthen your own resilience by implementing preventive measures, processes, and controls so you can focus on mitigating the residual impacts your third parties can have on your organization. If you don’t know where to start, I recommend the following areas:
Identify critical third parties that support your business.
This might require taking a step back to understand which externally provided products and services are the most important. “Important” should be defined as those products and services that generate the most revenue for your company, that have the greatest impact on your reputation or compliance, or that are important by other business metrics. Once you know what your most important products and services are then you can identify and associate those third parties that support your most important products and services. An organization might use many third parties, but the focus needs to be placed on those that are most critical to your organization.
Map the interdependencies between third parties and your organization.
Third parties are an extension of your organization in the work they do, so a critical next step is understanding the interdependencies between your business and these third parties – which systems do they support, as with a cloud service provider. Which third parties provides critical raw materials ? Or which third parties support your employees. This is critical because as you focus on building operational resilience across your internal “pillars” (business processes, IT infrastructure, facilities, and people) you have a better idea which third parties support each pillar. Your interdependence should also be measured against the level of reliance on each third party, which is particularly important if that third party is the only supplier for a particular input to your business, or that supports a key business process.
Understand third-party risks and how they can impact your organization.
No longer can you assume that because you have a contract with a third party that they are mitigating risks that may be passed to your organization. You must identify, assess, and mitigate third-party risks that could impact your organization. One way to do this is to work with your third parties to see their risk registers and understand how they’re treating the risks and what the impacts could be to your organization. If they won’t share the information yet they’re a public company, they you might have a bigger problem, but you can always obtain their 10K/Qs and review risk factors in those reports. Another way is to discuss with your third parties which risks have resulted in actual losses, or other risks they have identified and the probability of their occurrence, and other factors to understand how likely they are to affect you. Include appropriate risks in your risk register and treat the risk to your organization accordingly.
As part of this step, you must compare the residual risks that could impact your organization to your defined impact tolerances.. If the impacts exceed your defined tolerances, then you should address and mitigate the risks. Address the most important risks from your third parties that could impact your organization, be flexible to pivot to different risks when you need to, and ensure your response is commensurate to the risk and reward.
Create visibility through data and insights.
Good insights give you the visibility you need to manage the risks and take advantage of the rewards of working with your third parties. Insights come from tracking and measuring quantifiable resilience, performance, and risk metrics. Using balanced dashboards that give executives, program owners, business owners and others the data they need to make decisions and take action. You must be able to make agile decisions in real time to mitigate risk or take advantage of it.
Third parties are a critical part of doing business and sometimes they bring risk to your organization. By considering the topics above, you’ll be better able to convert your third parties from a risk factor to a strategic advantage.
For more information, visit Archer Operational Resilience. Contact us to learn how Archer can help you build resilience against third-party risks