Risk & the Enterprise: Managing Vendor Risk

1. Risk & the Enterprise: Managing Vendor Risk Chris McClean Principal Analyst, Research Director

2. Risk Management is maturing and expanding in the enterprise

3. GRC spans across many teams At your organization, who is responsible for the day-to-day coordination of your GRC program? Base: 53 global GRC decision-makers Source: Forrester’s Online GRC TechRadar Customer Reference Survey, Q3 2012

4. Involves a number of stakeholders At your organization, who is responsible for the overall success of your GRC program? Base: 53 global GRC decision-makers Source: Forrester’s Online GRC TechRadar Customer Reference Survey, Q3 2012

5. Customer use cases are diverse… Which of the following functions do you use the product for? Please select all that apply Base: 121 Customer references for the Enterprise and IT GRC Platforms Waves, Q4 2011 Source: Forrester’s Q2 2011 Global Governance, Risk, And Compliance Platforms Wave Customer Reference Online Survey

6. …but they haven’t changed much. Which of the following functions do you use the product for? Please select all that apply Base: 69 Customer references for the Enterprise GRC Platforms Wave, Q3 2009 Base: 121 Customer references for the Enterprise and IT GRC Platforms Waves, Q4 2011

7. Businesses continue to extend beyond their boundaries . . .

8. . . . but they don’t always look at their structural support .

9. Build a broad risk taxonomy 9

10. Build a broad risk taxonomy 10

11. Build a broad risk taxonomy 11

12. Build a broad risk taxonomy 12

13. Build a broad risk taxonomy 13

14. Build a broad risk taxonomy 14

15. Formalize risk processes to leverage opportunities.

16. Case study: device manufacturer CONTEXT: Understood need for security/risk involvement in vetting partner relationships and providing ongoing security oversight APPROACH: Security team is involved in procurement process, conducting mini-assessments to determine whether a more detailed evaluation is warranted. The goal is to establish the same baseline level of security among partners as expected for internal systems. Based on assessments, security will offer recommendation for remediation and/or reassessments. RESULTS: Clear agreement that business process owners own the risk and make the decision whether to accept, avoid, mitigate, etc. Security gets involved for higher-risk vendors (e.g., those that come on-site).

17. Case study: large global bank CONTEXT: Clear need to improve oversight of risk-related to third-party relationships, standardize risk measurement, and compliance assessments. APPROACH: Simplify initial assessments . . . 15 straightforward (primarily yes/no) questions to determine potential categories and estimated level of impact. Lighten risk requirements for low-impact vendors, choose from among 10 in-depth risk assessments for high-impact vendors where appropriate (viability, privacy, BC/DR, financial controls, etc.) RESULTS: Easier participation from vendor management and business. Better alignment with vendor performance data, metrics, processes, and decisions.

18. Recommendations  • Be very clear about the different types of third party risk you’re tracking, and who has responsibility for each.  • Create triggers to make sure risk and compliance efforts occur reliably within standard vendor relationship processes.  • Consider ways to open up communication with and among vendors about trends, patterns, best practices, etc.

19. Chris McClean cmcclean@forrester.com

20. Third-party Assurance — Case Studies

21. Global Financial Institution Challenge • 2,000 vendors and internal assets • Assurance activities in silos • Manual assessment tools • Automated, efficient, multi-tier process • Aligned, focused evaluation tools • Assessment coordination and schedule management • Issue and remediation tracking Solution • High program rating from external regulator • Management control of assurance process • Easy visibility of vendor risk rankings • Reduction in vendor assessment time and effort • Reusable assessment tools and patterns • Third-party satisfaction with streamlined process Results

22. Global Technology Services Company Challenge • Financial risk exposure due to contract non-performance • Objective evaluation of third-party contract risk • Develop standardized risk taxonomy and rating levels • Catalog of rated risks • Contract risk evaluation built into review process • Management of contract review documentation • Management reporting of gaps and regulatory non-compliance Solution • Reduced incidence of errors in previously manual process • Process-based exception triggers and alerts • Enhanced control of contract review documentation • Real-time access to contract performance and compliance status • Common risk repository for use throughout the organization Results

23. Third-party Assurance — Tools

24. Common Risk Framework • Consistent taxonomy • Risk categories • Risk responsibility

25. Vendor Impact Visibility • Systems • Business process • Facilities • Regulations • Standards …

26. A Common Business Language • Consistency of reference • De-facto authoritative sources • Easy global access • Alignment with other enterprise systems Screenshot: Application Hierarchy

27. Multiple Assessment Types • Questionnaire • Analyst findings • Controls testing Screenshot: Findings Report

28. Vendor Rankings • Assessment results • Risk ratings • Risk categories Screenshot: Vendor Risk Report by Rating with Categories

29. Issues and Remediation • In-context creation • Responsibility assignment • Collaboration dialog • Resolution tracking • Local and global reporting

30. Third-party Assurance — Process

31. Focus on High-Risk • Multi-step process — effective and efficient • Funnel to the risky few • Screen out low-risk entities • Benefits • Confident control of high-risk relationships • Elimination of redundant, unnecessary work • Additional subjective evaluation • Detailed scoring • Controls testing • Remediation

32. Full Relationship Lifecycle • New third-party relationships • Ongoing third-party relationships Resolve Issues Assess Monitor

33. Triggers for Action • Process-based • Exception-based • Alerts • Metric changes • Business change • Acquisitions

34. Program Alignment • Coherent third party interaction • Coordinated scheduling • Non-redundant evaluation tools • Shared evaluation results • Integrated risk picture • Coordination with internal asset reviews

35. Collaboration • Third-party access • Self-assessments • Issues • Remediation • Documentation • Regulatory access Screenshot: Vendor Specific Issues Report

36. Staged Deployment • Incremental • Incorporate departments one at a time • Go global gradually • Benefits • Immediate return • On-the-ground learning • Evolving optimization

37. For Additional Questions: Lewis Venezia Director of Sales, Risk Management Solutions (978) 451-7671 lewis.venezia@processunity.com