A guide to vendor risk management and vendor management : Aegify

1. A GUIDE TO VENDOR RISK MANAGEMENT AND VENDOR MANAGEMENT Managing hundreds and thousands of vendors, suppliers, outsourcers and third parties are getting more and more difficult due to shrinking budgets and minimized staffs in a number of organizations. Thus, vendor risk management performance is not at its peak. More and more companies are outsourcing the critical processes making it even more challenging in managing vendor risk management and its compliance. While the smallest companies also practically work with a number of vendors. Thus, a vendor management plays an important role as it is directly associated with the kind of success you are expecting. There are a number of key factors that one can enable to establish a cost effective and efficient vendor management program. Few of them may include, 1. Creating a strong internal policy and establishing it throughout the organization. 2. It is important that the vendor contract contains the terms and conditions that are necessary and agreed upon as it is one of the most imperative and initial part of creating a strong relationship

2. 3. Establishing an audit plan that will enable high impact findings. Thus, indicating the possible issues within the vendors environment 4. A report that includes the risks and the factors that are identified to be looked upon and to be corrected providing the required guidance 5. Company’s financial status, business continuity plans and the security controls need to monitored as these significantly increase the risk of the vendors association with the organization How does one identify whether the vendor is at a high risk or critical to the organization 1. The organizations most critical function is performed by the vendor 2. The dependency on the vendor is high 3. Since the dependency is high you cannot replace the vendor easily 4. The vendor is accessible to confidential information that cannot be reviewed to the public 5. There is no improvement in the vendors performance and support and is continuing to do so Performing due diligence on the associated vendors This process ensures the organizations relationships with the associated vendors are dependable and realistic. This is especially for the vendors who have access to confidential non public information. Few of the information that you collect during the review are, 1. The latest financial statements of the vendors 2. The list of references 3. The verification of the license, insurance and the documentation of the same 4. The history of the vendor and the associated companies 5. Audit reports 6. Technology used, security controls, past experience that reflects the ability of the vendor

3. 7. Reviewing the contract with the mentioned terms and conditions, requirements in service levels and renewal policies Creating a checklist for the vendor to follow can ensure that they adhere to the security practices. This will further keep the associated vendors from being hacked that will lead to loss of data of the customers. FOR MORE DETAILS:https://www.aegify.com/integrity-manager/