What is a Third Party Risk Assessment? 

 

A third-party risk assessment is a function of third party risk management (TPRM) and is an attempt to quantify the risk associated with a third party vendor that will be providing a product and or service to your organization.  

Why is Third Party Risk Assessment important? 

External relationships pose a significant cybersecurity threat to a business especially if these external vendors are not vetted. Every outside partnership runs the risk of opening the door to malicious actors invading their network and gaining access to sensitive information. Non-compliant vendors/Third parties can have disruptions and possible negative impacts on the organization’s compliance, brand, and operations. Additionally, third parties often continue to change their structure due to new competition, merger, and acquisition activity, and the addition of new capabilities, thus, more risk arises. This is why third party risk assessment is so important if you want to protect your organization. 

How to perform a Third-Party Risk Assessment  

Step 1: Know the types of vendor risk 

When you start to evaluate third parties, it is important that you understand all the risks involved in working with external vendors. If you don’t know the risks, it could be catastrophic for your business if something goes wrong. Listed below are just a few of the risks you need to be on the lookout for. 

Financial risk: Are they financially stable? 

Compliance risk: Do they follow current laws and regulations? 

Subsequential risk: Do they use third parties for any of their processes that could affect your company? 

Resource risk: Do they have adequate resources to do what you’re paying them for? 

Replacement risk: How easy would it be to replace them if they ceased operations? 

Reputational risk: How will working with them affect your company’s reputation internally and externally? 

Some of these risks might not apply depending on your business and the purpose for which you are hiring vendors. However, it is important to understand all potential risks when evaluating vendors. 

Step 2: Determine risk criteria 

Once you have a complete understanding of all the risks, you will need to create risk criteria for third-party risk assessments. These criteria will vary depending on the type of business you do and what vendor you use. 

Assess vendors regularly to avoid bias and ensure that you only hire the right vendors. It might be tempting to cut corners to expedite third parties through the assessment process just because someone you know works there. Create a vendor risk assessment that follows a specific format with scoring criteria. Use it for each evaluation. 

Step 3: Assess all vendors 

Third-party risk assessments aren’t only for supply chains and software. Before you sign a partnership, it is important to evaluate every vendor, regardless of how small or what service or product they offer. 

Even if you have not done a formal risk assessment, it is worth evaluating janitorial services, commercial contractors, and landscapers. They could be a threat to your company if they have access to your files, data, and/or physical space. No third party is too small, even the third parties at the bottom can impact your company in a negative way. 

Step 4: Assess each product and service 

A third party risk assessment should include two types of assessments. One that is focused on the vendor as a whole and one for each product or service that you plan to buy from them. 

An evaluation of the vendor’s risk to your company will help you assess the risks. How does their reputation affect yours? Are they able to comply with legal business practices? Is their customer service reliable and fast? 

A product-level assessment, on the other hand, shows you the potential risk associated with a particular product. If you are looking to purchase case management software, you may also want to assess the company. 

Is the software safe? 

What time will it take for employees to master it? 

What is the cost of this? 

Is it in compliance with applicable laws (data privacy, reporting etc. 

You can get a complete picture of the potential risks by evaluating both the company as well as the product. This will help you decide whether to continue a business relationship. 

Step 5: Classify vendors by risk level 

After you have assessed a vendor, you should determine its overall level of risk. Separating potential vendors into risk levels can help you quickly determine whether to work with them and speed up the risk management planning process if so. 

First, score the vendor as high-, medium- or low-risk based on your risk criteria. Then, give the vendor a business impact score. In other words, how important is the vendor and their product or service to your organization? 

Finally, decide what amount of due diligence you will do for vendors at each risk level. This streamlines the process, improving efficiency and consistency and eliminating bias. \

Step 6: Audit vendors 

Audit and select partnerships according to their answers and independent review. Depending on the level of risks associated with your business, it can be a good Idea to schedule and onsite visit.  

Why Use OpenPages for Third Party Risk Assessment? 

Issue / incident management 

Guides vendor risk issues through a systematic process of investigation and resolution to enhance collaboration with vendors on corrective action. Provides real-time visibility into vendor issues. 

Third party risk assessment questionnaires 

Streamlines and standardizes the process of creating, distributing, and following up on vendor risk surveys and questionnaires; helps qualify vendors based on assessment scores. 

Third party integrations 

Eliminates the need for time-consuming point-in-time vendor assessments with the help of a Security Scorecard for IT security benchmark scores and Shared Assessments for SIG Questionnaires. 

IBM OpenPages Strategy 

Industry Strategy 

IBM OpenPages has a web-based service called Assessment for IT VRM. This product is an out-of-the-box solution that allows up to 500 vendors and 40 concurrent business users to understand their third-party risk exposures through the vendor relationship.  

Geographic Strategy

IBM has a wide geographical presence, with operations in 170 countries and a global network of system integrators and integration partners. iTech US, IBM’s premier GRC partner, specializes in OpenPages GRC implementations and license resell.