This document summarizes a presentation given by Linda Tuck Chapman on third party risk management. The presentation covers key topics such as who sets the rules for third party oversight, the importance of lifecycle management and governance, applying a three lines of defense framework, and ensuring senior management has sufficient insight. It also includes polling questions to gauge attendees' organizations' progress in implementing third party risk management programs.

1. Third Party Management
… the journey continues…
5 October 2017
Linda Tuck Chapman
lindatuckchapman@ontala.com
416.452.4635 | 917.831.2923

3. 3
Linda Tuck Chapman
President, ONTALA
416.452.4635 | 917.831.2923
lindatuckchapman@ontala.com
A recognized expert in third-party lifecycle and risk management.
outsourcing governance and third-party optimization
Career highlights:
• CPO, BMO Financial Group
• President & CEO Education Marketplace
• CPO, Fifth Third Bank
• CPO and VP Executive Shared Services, Scotiabank Group
Third Party Management Leadership Profile:
• Author: “Third Party Lifecycle and Risk Management – What
You Should Know” (available on Amazon October 2017)
• Author: RMA Journal, Wall Street Risk Journal, industry
publications
• RMA: Third Party Management Specialist, Facilitator, Trainer
• SRC: Chair, SRC Thought Leaders Council
• SHARED ASSESSMENTS GROUP: Advisory Board member
• CORE: Lecturer
Linda Tuck Chapman
© 2017 ONTALA Performance Solutions Ltd..Confidential Information. Do not copy or distribute.

4. 4
Agenda
1 Today’s speaker
2 Who sets the rules?
3 Lifecycle management
and governance
4 3PRM applied
5 Three lines of
defense
6 The end game
7 Contact information
© 2017 ONTALA Performance Solutions Ltd..Confidential Information. Do not copy or distribute.

5. 5
Regulatory
Financial
THIRD
PARTY
MANAGEMENT
SENIOR
MANAGEMENT
INFORMATION
SECURITY
FINANCE
OPERATIONAL
RISK
COMPLIANCE
LEGAL
Which stakeholders set the rules?
Customers
Third Parties
© 2017 ONTALA Performance Solutions Ltd..Confidential Information. Do not copy or distribute.

6. 6
Polling Question #1
What is the #1 reason why your company has/is implementing a third party management program?
1. It’s a regulatory requirement
2. Our clients demanded it
3. To respond to an increased threat landscape
4. We have a strong risk culture, no question we need this
5. Not there yet
6. Not sure
© 2017 ONTALA Performance Solutions Ltd..Confidential Information. Do not copy or distribute.

7. 7
Simplifying complexity is a critical success factor
Segmenting critical and risky
relationships and separating them from
the thousands of possibilities is reliant on
effective tools and processes
Good governance relies on
knowledgeable risk specialists,
actionable information and insight, and
a strong risk culture
Operating Framework
Governance Framework
Source: Linda Tuck Chapman, Ontala 2017
© 2017 ONTALA Performance Solutions Ltd..Confidential Information. Do not copy or distribute.

8. 8
Three “Lines of Defense” framework
Source: IIA Position Paper on the Three Lines of Defense in Effective Risk Management and Control (January 2013); Adapted from ECIIA/FERMA Guidance
on the 8th EU Company Law Directive, article 41
© 2017 ONTALA Performance Solutions Ltd..Confidential Information. Do not copy or distribute.

9. 9
Polling Question # 2
Has your company implemented a “three lines of defense”
framework for managing operational risk?
1. Yes
2. No
3. Not sure
4. This is a new concept for me
© 2017 ONTALA Performance Solutions Ltd..Confidential Information. Do not copy or distribute.

10. 10
Translate policy and processes into action
relationship-level
Management and
Monitoring
1st LOD Templates (e.g.) 2nd LOD Templates (e.g.)
Service Organizational Control (SOC)
Review
IT Risk Assessment
Business and Performance Reviews Cloud Adequacy Assessment
Consumer Compliance Review Offshore Control Adequacy
Usage Planning Business Continuity Adequacy
Contingency and Termination Planning Compliance Testing
Key Indicators (SLA/KPI/KRI) Compliance Due Diligence
Standard Due Diligence Contract Control Adequacy
Standard
Assessments, Due Diligence,
Controls and Monitoring
• High(est) criticality
• Highest risks
• Significant issues and incidents
• Specific risks (e.g. high risk
cloud vendors)
Management procedures
Risk Dashboard
Risk Reports (e.g.)
Standard risk assessment and evaluation templates
Action plans
Remediation management
Exception tracking
business unit level
Independent Challenge and
Exception Management
AggregatedReporting
Policies, tools and processes enterprise level
Third Party and BU
Scorecards
Third Party
Management Platform
© 2017 ONTALA Performance Solutions Ltd..Confidential Information. Do not copy or distribute.

11. 11
What does your RASCI look like?
RASCI: Responsible, Accountable, Support, Consult, Inform
© 2017 ONTALA Performance Solutions Ltd..Confidential Information. Do not copy or distribute.

12. 12
Polling Question #3
Which elements of your program are most problematic?
1. Adoption and engagement in the 1st Line of Defense
2. Under resourced 1st Line of Defense
3. Under resourced 2nd Line of Defense
4. Too much complexity and work for too few benefits
5. Other
6. Not sure
© 2017 ONTALA Performance Solutions Ltd..Confidential Information. Do not copy or distribute.

13. 13
You know
what you
don’t
know
You know
what you
know
You
don’t know
what you
know
You
don’t know
what you
don’t
know
Source: Linda Tuck Chapman
Johari’s window is a way to be thoughtful about risk
© 2017 ONTALA Performance Solutions Ltd..Confidential Information. Do not copy or distribute.

14. 14
Polling Question #4
Would senior management say that your program gives them all of the information and insight
they need?
1. Yes, we’ve got this nailed
2. Not yet, but we’re headed in the right direction
3. Not yet, it needs a lot of work
4. Not sure
© 2017 ONTALA Performance Solutions Ltd..Confidential Information. Do not copy or distribute.

15. Q&A

16. 16
MCO Third Party Risk Management
• Affordable SaaS solution
• Inventory of Third Parties
• Vendor Scoring and Risk Assessments
• Due Diligence and Screening
• Certifications and Attestations
• Contract Management
• Integrates with Employee Conflict of Interest
• Gifts and Entertainment
• Outside Business Interests
• Personal Trading
• Attestations
• Integrates with Trade surveillance solution (KYT)
• Integrates with Customer Suitability solution (KYC)
© 2017 ONTALA Performance Solutions Ltd..Confidential Information. Do not copy or distribute.

17. 17
Polling Question #5
Is your program automated?
1. Yes
2. No
3. Partly
© 2017 ONTALA Performance Solutions Ltd..Confidential Information. Do not copy or distribute.

18. 18
Contact
MyComplianceOffice
Email: advance@mycomplianceoffice.com
Website: https://mco.mycomplianceoffice.com
lindatuckchapman@ontala.com
Linda Tuck Chapman
416.452.4635 | 917-831-2923
www.ontala.com
© 2017 ONTALA Performance Solutions Ltd..Confidential Information. Do not copy or distribute.

19. Thanks for listening!
Thank You!