Enterprise Risk Management Teams Need a Better Approach to Third Parties
In a Gartner survey of 100 executive risk committee members in September 2022, 84% of respondents said that third-party risk “misses” resulted in operations disruptions (see Figure 1). Gartner defines a third-party risk “miss” as a third-party risk incident resulting in at least one of the outcomes in Figure 1 once or more in the 12 months leading up to the survey.
“Most organizations have seen an increase in the number of third parties under contract in recent years,” said Chris Matlock, vice president, research in the Gartner Legal Risk & Compliance Practice. “Moreover, a majority of organizations are also using third parties for new-in-kind-services and have become more reliant on them to conduct their operations. While increased use of third parties can improve business operations in many ways, it also introduces risks that are causing notable impacts on organizations.”
Figure 1: Evidence of Third-Party Risk “Misses”
“ERM involvement in third-party risk management activities has increased across the board since 2016,” said Matlock. “However, just doing more isn’t enough because the characteristics of third-party risk undermine the effectiveness of a typical ERM setup.”
ERM is struggling to elevate the right issues because it is generally failing to limit its focus to a manageable set of issues. ERM leaders are not clearly defining which issues must be acted on first, and they are not typically preparing their audiences well to take tangible steps on the issues they surface.
Enterprise Third-Party Risk Management
There are three aspects that ERM must do differently to improve effectiveness in managing third-party risk in a large organization, an approach Gartner calls enterprise third-party risk management. Essentially, this is an approach to help ERM teams manage the information overload that is being created by the exponential increase in risk volume and variability brought about by the rapid growth of third parties use.
- Third-party risks tend to be high volume, heterogeneous in nature, and vary greatly in importance across the business. It is hard, therefore, to identify and prioritize what matters most. ERM must first isolate and combine only those inputs that matter most at the enterprise level, enabling them to focus on aggregating the most important inputs and addressing the most critical enterprise third-party risks.
- ERM must work to enable alignment across a diverse set of risk owners to obtain a holistic view and create opportunities for them to work towards consensus. In practice, this means facilitating direct thought-partnership between risk co-owners with ERM adding expertise and aligning actions, as opposed to ERM acting as a central co-ordinator of all risk information and mitigation.
- ERM’s role as a trend spotter is also undermined by the expanding third-party landscape because the potential issues are too numerous and available data is often point-in-time and lagged. Again, the solution is to narrow down the scope of what is being monitored, limiting focus to the most critical emerging issues and proactively tracking them with a set of easily monitored forward-looking indicators that enables ERM to reliably spot critical enterprise risk trends.
“With third-party risk exposure elevated and a multitude of incoming threats on the horizon, risk committees are expecting ERM to play a greater role in managing third-party risk,” said Matlock. “Yet traditional ERM posture is struggling to provide a concise, actionable view of third-party risk at the enterprise level. That’s why ERM must focus on enterprise third-party risk management, which involves defining enterprise-level priorities, enabling cross-functional alignment, and monitoring forward-looking indicators.