Course Level:

Intermediate

Advance Preparation:

Print and review course materials

Method of Presentation:

On-Demand Webcast

Prerequisite:

General knowledge of third-party risk management

Course Code:

149766

NY Category of CLE Credit:

Law Practice Management

Total Credit:

1.0 CLE

Olga Voytenko, Head of Third-Party Risk Management, MD
State Street Corporation

Sandeep Bhide, Vice President, Product Management
TPRM Technology Expert
Process Unity

Olga Voytenko, Head of Third-Party Risk Management, MD

State Street Corporation

Sandeep Bhide, Vice President, Product Management TPRM Technology Expert

ProcessUnity

TPRM Trends:

• TPRM is a key risk for financial industry.  Reliance on third party providers: IT services, Cloud environment, niche expertise are necessary for the organizations who aspire to remain competitive and relevant.  The risk associated with outsourcing continuous to increase.  The breadth of risk domains is expansive: Contracting/Legal, Business Continuity, Operational Resiliency, Operational Risk, Concentration, Cyber Information Security, Physical Security, Privacy, Anti-Bribery and Corruption, Anti-Money Laundering, Compliance, Country, Financial Accounting, Reputational, Tax Evasion, Financial viability and Step-In Risks, and climate change.
• Regulatory mandates are converging and raising the bar for financial institutions and fintech companies
• The number of incidents of cyber-attacks continue to rise; as do geo-political and climate change concerns.
• No abatement of third party risks especially Cyber, infosec, corruption/fraud related (threat landscape is expanding/becoming more complex and third parties are the weakest link)
• Greater regulatory focus on third party risk (following from the pandemic recovery and continuing supply chain disruptions)
• TPRM (by itself and as a byproduct of Cyber) is becoming a first priority for enterprises
• Greater realization that TPRM should not be done in a silo but, connected and contextualized within org wide processes

Talking points:

• Incorporate automation to reduce cycle time and agility
• Effective calculation of the inherent risk of a product/service and consequent auto-scoping of due diligence roster
• Incorporate industry-standard questionnaires into assessment processes
• Improve vendor response rates and submission quality by reducing vendor fatigue
• External content and ratings to assist in ongoing vendor monitoring

• There are three foundational components: People, Process, and Technology:
  • The leader of TPRM needs to have deep expertise across all of the risk domains associated with third party and outsourcing risk.
  • The framework must be risk based and fit for purpose.  The design must be intuitive, intelligent, and agile enough to bifurcate and delineate relevant due diligence and risk assessments to the level of exposure associated with specific service type and nature of the relationship.  The process must be repeatable in a consistent manner with consistent and measurable results.
  • Solid platform with advance workflow functionality is vitally important, regardless of organizational size and complexity.  The platform has to fit the purpose and offer clear view into SLAs associated with each step of the third party lifecycle and connect multiple stakeholders involved.

Outlook:

• TPRM programs becoming more integrated and consistent with cross functional utilization within companies
• Companies wanting to unify their cybersecurity landscape with TPRM, enabling them to measure control effectiveness and prioritize remediation investments

• The TPRM practice is evolving at rapid pace, organizations are expected to look beyond 3rd party reliance.  As risk practitioners we need to have a clear understanding of our 4th and Nth third parties, our concentration risk from a single supplier, limited suppliers, geographic perspective.
• The focus is maturing from period due diligence as a point in time, to real time monitoring, and capabilities to rapid incident response.

• Vendor Risk Managers/Officers
• Compliance Managers/Officers
• Information Technology Officers
• VPs/Directors/Managers of IT
• Chief Risk Officers
• Risk Management Executives
• Chief Compliance Officers
• Chief Information Officers
• Chief Operating Officers
• Risk Analysts
• Business Analysts
• Internal Auditors