As supplier ecosystems continue to become more sophisticated, the challenge of navigating interconnected dependencies has grown to a point that operational resiliency is no longer a nice to have, it is vital to an organizations’ ability to operate and grow. In recent years, industry experts, researchers and educational leaders have come to recognize the critical role that a supplier risk or third party risk management program (“TPRM”) plays in achieving operational resiliency for a firm. However, developing and maintaining a program that is sufficiently adaptable and robust to address emerging risks and regulatory changes, while continuing to deliver operational resiliency is a practical challenge shared by many of us as risk management leaders.
As leaders, it’s worth asking ourselves if robustness and adaptability are just buzzwords to create hype or if anyone has really cracked the code to operational resiliency, and how do you even measure this? Addressing the question of measurement is quite simple:  if your risk programs incorporate emerging risks, changing landscapes and new monitoring advancements on an ongoing basis without having a material undesirable impact on internal functions and businesses, your program is adaptable. Your program’s robustness is however dependent on its positioning towards attacks, adverse events and changes and can be measured by its effectiveness in identifying, managing, and mitigating risk foran organization.
The more difficult question to answer is how to get there. In today’s world of complex business models and strategies, third parties play an essential role in enabling organizations maintain competitive edge, achieve firm goals, client satisfaction and sustainability. Outsourced services bring more than just cost effectiveness to the organization – a firm may depend on a providers’ expertise to improve and sustain their capabilities and services. On the other hand, it comes with risks including but not limited to reputational, continuity, compliance, and cybersecurity. How we mitigate and manage these associated risks is what moves us towards an operationally resilient stage where we are well-informed and well-equipped to address these as organizational leaders.
The good news is every risk is identifiable and mitigatable to some extent. Although, there is no one-size-fits-all, step by step guide to building a robust TPRM program, the robustness of a risk management framework depends on tailoring the program to the organization, its risk appetite and tolerance as well as its exposure. Nonetheless, there are ways every risk and control program can become more robust if risk leaders focuson strategic alignment with organizational goals, strategy, and vision with their risk management framework. Third Party Risk Management is classified as niche in the realm of risk management where we are required to be either an expert or at least a knowledgeable contributor across all sources of risk that may have a material exposure to our organization. This means we can have a uniquely large sphere of influence that allows us to develop the sort of collaborative relationships that will ensure TPRM alignment with an organization’s strategic goals and therefore maximize its impact on the push for operational resiliency.
There are five key principles risk leaders should focus on when building or enhancing a risk and control function that critically contributes to operational resiliency.
“Risk Management is about doing good business!”
While often seen as regulatory or emerging risks driven, risk management is really a core pillar of doing good business. Risk management functions help organizations put their clients first, maintain their competitive advantage, provide exceptional and undisrupted service, and develop innovative products. Proactively identifying and managing risks across operations, limits the potential for negative impacts such as operational disruption or vendor failure resulting in material impact on deliverables. Compliance to policies, guidelines, and procedures – all the hallmarks of robust risk management – are resulting benefits and not the foundational pillar of risk management. Effective risk management focuses on processes and tools to identify, manage, and mitigate risks while bringing efficiency, awareness, and a streamlined approach to the organization.
“Collaboration and Partnership across the organization is an accelerator for operational resilience!”
Successful risk management programs are built on the premises of strong collaboration and partnership across different businesses and lines of defense, as well as suppliers. You cannot build a robust risk management program without tailoring it to your organization and you cannot tailor it to your organization without understanding business requirements, strategy, and dependency. A streamlined risk management program is a promoter of effective challenge and partnership across all different business areas to develop a cohesive and continuously improving risk management function.
“Awareness is the key for successful implementations”
How many times you have heard of a new program or requirement through a policy or a procedure? While it can be hard to bring a 1:1 awareness in a large organization, a robust risk management program utilizes channels across the organization as well as simple tools and marketing strategies to bring awareness, develop interest and foster a risk manager culture in the organization. The simpler the process, the higher its observance. A process is simple when its well understood and its well understood through awareness and open dialogues.
“The Double Ps serve as a core foundation for robustness”
Proactive & Preventative! Essentially, the double P’s is what serves as your main defense against the threats and disruption. A robust risk management strategy focuses on not only identifying but also predicting, analyzing, and mitigating potential risks. Being proactive and preventative can take form in different ways whether through use of intelligence gathering and continuous monitoring or through processes that serves as gate keepers and identifiers. A well-constructed program looks at the risk management landscape of an organization from a future state perspective while sustaining and continuously improving the present.
“Adaptability go hand in hand with lessons learned”
It’s easy to become complacent about your program in good times. However, the true test of a risk management program is how well it manages and mitigates risks in the face of an adverse event or identification of a material issue. An operationally resilient organization does not focus on having no issues- we all know that some are unavoidable- butan operationally resilient organization is prepared with correct tools, understanding, and processes, to address issues while continuing to learn from them and apply these lessons to further enhance and improve their risk functions.
In short, third party risk management, or risk management and governance in general, share core principles that enable organizations to not only achieve their strategic objectives effectively but also sets them on an efficient path for future growth. It takes organizations intentional change and streamlined approach to risk management to accelerate their success towards resilience.
Disclaimer: Opinions are of Madiha Fatima as an individual and as an industry leading expert, not attributed to any particular organization.