Vendor Risk Management

What is Vendor Risk Management (VRM)?

Vendor risk management (VRM) is an area of risk management that deals with identifying and mitigating risks in vendor management. It helps ensure security for both parties by providing visibility on what vendors an organization works with, how they work with each other, and whether or not vendors have sufficient security controls in place. VRM helps address compliance, privacy, and business continuity challenges, which have become more commonplace in the “remote working age,“ where companies have the majority of their employees working from home. The objectives of VRM vary widely depending on several factors, including company size, industry, and applicable laws based on its jurisdiction. As more companies embark on a digital transformation, managing vendor risk becomes of utmost importance to companies in all industries. 

Because minimizing business disruption is a main objective of vendor risk management, organizations use it to manage critical tasks and processes that are outsourced to third parties or vendors. It’s vital because disruption within the vendor’s business will lead to disruption in businesses that use said vendor’s services. Despite the risks involved, vendor risk management is still a necessary component of modern businesses. An effective VRM program can reduce an organization’s operational costs by outsourcing specific tasks and taking advantage of vendor expertise that the organization may not have in-house. 

Aside from risk management, a proper VRM program helps in evaluating and onboarding new vendors, ensuring that they’re equipped to perform their tasks and achieve set goals. It also helps monitor vendor relationships as they progress, helping determine new risks as they arise and improving vendor performance. A VRM program also helps achieve the following:

• Identifying redundant vendors
• Ensuring compliance with industry requirements and global regulations
• Tracking security controls and risk mitigation efforts
• Data flow and access management
• Offboarding vendors and recordkeeping for compliance

How to Conduct a Vendor Risk Assessment

A vendor risk assessment is a process that helps organizations determine the third-party provider or vendor that could best serve their business needs. It involves identifying potential risks of working with specific vendors and deciding whether or not these risks are worth taking by looking at the possible rewards of the business relationship. Vendor risk assessment can often be a tedious and time-consuming process because the decisions made should be based on an organization’s business objectives, current needs, and policies and regulations.

However, choosing not to conduct a vendor risk assessment exposes the organization to compliance and other regulatory issues faced by the vendors they work with.

Below are the steps in conducting an effective vendor risk assessment:

• Know what risks you’re facing.
  Before entering into any vendor partnerships, it’s vital that you’re aware of the types of risk you may face. Depending on the type of business, your organization could be exposed to the following:
  • Financial risk, e.g., when vendors aren’t financially stable
  • Compliance risk, e.g., when vendors don’t follow regulations
  • Operational risk, e.g., when vendors’ day-to-day policies aren’t up to standard
  • Strategy risk, e.g., when vendors steal trade secrets or intellectual property
  • Resource risk, e.g., when vendors don’t have the necessary resources to deliver what’s expected of them
  • Geographic risk, e.g., when vendors operate in a risky or unstable location
  • Technical risk, e.g., when vendors lack the necessary infrastructure
  • Sub sequential risk, e.g., when vendors employ a third-party for any of their processes
  • Replacement risk, e.g., when vendors need to be replaced due to unforeseen circumstances
  • Reputational risk, e.g., when working with specific vendors negatively affect the company’s reputation
• Define risk criteria.
  Depending on the type of business, each organization should develop its own criteria for vendor risk assessments. For example, businesses that handle sensitive data should prioritize data privacy and other issues related to technical, resource, and strategy risk. On the other hand, businesses that suffer great losses due to service interruptions should prioritize operational and geographic risk. Design an evaluation and scoring system that can be used for every vendor risk assessment to help maintain objectivity.
• Get advice from experts.
  No single member of an organization can be an expert in all types of vendor risk. As such, it’s helpful to get insights from people within the company or your professional network to get advice regarding specific topics covering the different types of risk. You could also create a vendor risk assessment team if you have the manpower and resources, enlisting the help of people who have a high level of knowledge about vendor risk or those who manage these risks on a day-to-day basis.
• Assess vendors and the products and services they provide.
  Each vendor, no matter how small, should be evaluated before establishing a relationship with them to avoid problems along the way. Vendor risk assessments should ideally comprise of two separate assessments: an assessment of the vendor itself and an assessment of the product or service it provides. The former will help determine the risks the organization could face in working with a specific vendor; the latter will focus on what the vendor provides and if it meets the agreed upon criteria. This two-prong approach will provide a big-picture view of the potential risks involved in establishing and maintaining a business relationship with a vendor.
• Categorize vendors according to risk level.
  When assessing vendors, you should be able to determine the overall level of risk in working with them. Categorizing vendors according to risk level speeds up the selection process and helps make the creation of a vendor risk management plan easier and more efficient. Categorizing vendors also determines the amount of due diligence you need to do on each vendor, streamlining the organization’s overall governance process.
• Create a vendor risk management plan.
  When working with vendors, it’s vital that you have a contingency plan in case things don’t work out. This is where a vendor risk management plan comes in. It helps organizations manage and mitigate risks posed by working with specific vendors, allowing you to respond promptly when disaster strikes. An effective vendor risk management plan provides details like specific responses to certain scenarios and the role of employees responsible for each area of the business and type of risk.
• Conduct periodic vendor risk assessments.
  initial vendor risk assessments do not suffice if you’re looking to avoid issues in the long-term. Vendor relationships are nurtured through periodic assessments to ensure that expectations are always aligned and that vendors are providing what they’re supposed to. Revisiting vendor agreements is vital because vendors might update services and products through time, and it should be ensured that these updates or changes still adhere to the original contract and meet business requirements. You may conduct vendor risk assessments monthly or annually; regular monitoring ensures that business relationships remain safe and beneficial for both parties.

What is a Vendor Risk Management Plan?

A vendor risk management plan covers an entire organization and enumerates and defines the specific roles, performance metrics, and codes of conduct, among other things, that have been agreed upon by both vendor and organization. To ensure the long-term success of the plan, it undergoes strict and frequent reviews performed by both parties. Testing is also done to see how the plan will fare in real-world situations and to identify areas for improvement. Forgoing a VRM program increases an organization’s risk of lost revenue, compliance issues, and other losses due to vendor negligence. A vendor risk management plan provides specific details and uses step-by-step process checklists to ensure that no task or step is missed in the performance of a vendor’s duties. The entire organization takes part in creating and implementing a vendor risk management plan, and as such, provides visibility to various teams across the organization as needed, specifically the compliance, HR, legal, and management teams.

Gartner Magic Quadrant for IT Vendor Risk Management Tools

IT has become an essential component of every business in today’s digital-first landscape. As such, IT vendor risk management tools have become ubiquitous components of forward-thinking organizations looking to future-proof their business. These tools help in tracking IT vendor risk and facilitating regulatory compliance. Gartner’s Magic Quadrant takes this a step further by providing insights on this dynamic market. The quadrant categorizes companies based on their completeness of vision and ability to execute:

• Niche players: low/average completeness of vision, low/average ability to execute
• Challengers: low/average completeness of vision, high ability to execute
• Visionaries: high completeness of vision, low/average ability to execute
• Leaders: high completeness of vision, high ability to execute

How to Get a Vendor Risk Management Certification

There are certification courses available online that will provide the necessary skills and expertise to effectively manage vendors. Available courses will vary, but basic courses will cover topics that include the three pillars of successful vendor management, the procurement lifecycle, and the process of selecting, motivating, and managing vendors. In the US and Canada, certification requires that you attend at least 90% of the course, participate actively in course exercises, and score at least 72% in the assessment at the end of the course.

How to Create a Vendor Risk Management Checklist

List of vendor risk management companies

• OneTrust
  The OneTrust platform implements central agile workflows across privacy, security, data governance, GRC, third-party risk, ethics and compliance, and ESG (environmental, social, and governance) programs.
• Archer
  Archer is the risk, security, and governance division of RSA Security that features an integrated risk management/GRC (governance risk compliance) platform.
• ZenGRC
  ZenGRC is a cloud-based SaaS solution that acts as the central platform for an organization’s information security ecosystem, allowing for end-to-end risk management, continuous monitoring, and audit management capabilities.
• SecurityScorecard
  A global leader in cybersecurity rating, SecurityScorecard boasts a patented rating technology used by over 1,000 organizations for third-party risk management, self-monitoring, and cyber insurance underwriting.
• HighBond
  Highbond is an end-to-end governance, risk management, and compliance platform that streamlines collaboration across organizations and delivers best practices via an award-winning interface.