Supplier Assurance During COVID-19

Supplier Assurance During COVID-19
Supplier Assurance Has Never Been More Important During Uncertain Times 14th April 2020
Who are we? 2 Alex Hollis VP GRC Services SureCloud Alex.hollis@surecloud.com Matthew Davies Product Marketing Director SureCloud Matthew.davies@surecloud.com
Agenda • Third Party Risk Management Checklist • What should you be asking your suppliers now? • Why your fourth parties are so important • Embedding your risk & control culture in your suppliers • Using technology to enhance your program • Q&A
4 Third Party Risk Management Checklist
5 Third Party Risk Management Checklist  Central list of your vendors  Identify critical vendors  Link vendors to business assets  Prioritise vendors based on budget and time  Assess vendors www.surecloud.com © 2020 SureCloud. All rights reserved.
6 Third Party Risk Management Checklist  Central list of your vendors  Identify critical vendors  Link vendors to business assets  Prioritise vendors based on budget and time  Assess vendors But don’t worry if you haven’t operationalised these processes in a recent TPRM survey; Most firms are yet to automate inventory updates, and 89% of organisations are still relying on manual processes to support their TPRM program. www.surecloud.com © 2020 SureCloud. All rights reserved.
7 What should you be asking your suppliers now?
8 What should you be asking your suppliers now? www.surecloud.com © 2020 SureCloud. All rights reserved. Affected services or products Fourth parties Service/ product locations TPRM assurance Remote working Continuity & recovery planning Risk management
15 Why your fourth parties are so important
16 Security breaches from 3rd and 4th parties RSA Security: • April 2011 – via a recruitment company and xls file • Tens of millions of SecurID hardware tokens would have to be re-issued to clients British Airways: • September 2018 – via online payment forms • Approximately 380,000 transactions were affected and a proposed fine of £183m www.surecloud.com © 2020 SureCloud. All rights reserved.
17 Why are fourth parties important? www.surecloud.com © 2020 SureCloud. All rights reserved. Your Organisation
18 Why are fourth parties important? www.surecloud.com © 2020 SureCloud. All rights reserved. Your Organisation Third Party Vendor Third Party Vendor  What if your third party is also working with multiple third parties to provide your services?
19 Why are fourth parties important? www.surecloud.com © 2020 SureCloud. All rights reserved. Your Organisation Third Party Vendor Third Party Vendor 4th Party Vendor 4th Party Vendor 4th Party Vendor 4th Party Vendor 4th Party Vendor 4th Party Vendor  Fourth parties can infiltrate a company’s data through the third party relationship  Fourth party risks can arise from contractors, consultants and other vendors working with your third- party vendor
20 How to address fourth parties? • Targeted questions of your third parties to understand their fourth parties www.surecloud.com © 2020 SureCloud. All rights reserved.
21 How to address fourth parties? • Targeted questions of your third parties to understand their fourth parties • Work actively with your third parties to request information and get a full understanding of the fourth parties involved www.surecloud.com © 2020 SureCloud. All rights reserved.
22 How to address fourth parties? • Targeted questions of your third parties to understand their fourth parties • Work actively with your third parties to request information and get a full understanding of the fourth parties involved • Review your third parties own TPRM policies and practices www.surecloud.com © 2020 SureCloud. All rights reserved.
23 How to address fourth parties? • Targeted questions of your third parties to understand their fourth parties • Work actively with your third parties to request information and get a full understanding of the fourth parties involved • Review your third parties own TPRM policies and practices • Require your third parties contractually commit to notifying you prior to contracting with a fourth party vendor www.surecloud.com © 2020 SureCloud. All rights reserved.
24 How to address fourth parties? • Targeted questions of your third parties to understand their fourth parties • Work actively with your third parties to request information and get a full understanding of the fourth parties involved • Review your third parties own TPRM policies and practices • Require your third parties contractually commit to notifying you prior to contracting with a fourth party vendor • Identify trends in fourth parties and conduct onsite audits if possible www.surecloud.com © 2020 SureCloud. All rights reserved.
25 Embedding your risk & control culture in your suppliers
26 Embedding your risk and control culture in your suppliers Current Situation: • Organisations are conducting point in time assessment which is often regulatory focused Changing the mindset: • Embed your organisation’s risk and compliance processes into your suppliers • Actively incentivise suppliers to report risk and compliance data • Document and manage the risks and controls that occur from your supplier relationships • Track and assign remediation activities to your suppliers www.surecloud.com © 2020 SureCloud. All rights reserved.
27 Using technology to enhance your program
28 Using technology to enhance visibility of your vendors Current Situation:  Your organisations third party risk management program/solutions isn’t integrated into the wider organisation. How to enhance your program:  What existing technology we have will provide us with greater insight?  What other technology will provide us with better insight? www.surecloud.com © 2020 SureCloud. All rights reserved.
29 Technology you can leverage  What existing technology we have will provide us with greater insight? www.surecloud.com © 2020 SureCloud. All rights reserved.  What other technology will provide us with better insight? • Incident Data • IT Assets • Contract Data • Risk and Compliance Data • Financial Stability Data • Cyber Risk Rating • Regulatory Data • Corruption Perceptions Index
30 Q&A
31 Introducing SureCloud's Complimentary Supply Chain Solution With the free solution you can: 1. Document key processes and assets 2. Document your key 3rd and 4th parties 3. Directly assess your supply chain 4. Contribute to a global insight report 5. Define and manage both issues and exceptions 6. Report results via intuitive dashboards https://info.surecloud.com/free-supply-chain-solution www.surecloud.com © 2020 SureCloud. All rights reserved. Upcoming Webinar: How to Understand and Build the Resilience of your Supply Chain
32 Get in touch Carry on the conversation... - @surecloud alex.hollis@surecloud.com matthew.davies@surecloud.com
Thank you www.surecloud.com sales@surecloud.com

Check these out next

Supplier Assurance During COVID-19

Recommended

More Related Content

Similar to Supplier Assurance During COVID-19(20)

Recently uploaded(20)

Supplier Assurance During COVID-19

Editor's Notes