SlideShare a Scribd company logo
1 of 16
Implementing an
Effective Third-party & Vendor
Risk Management Program
CUSTOMER PRIVACY &
DATA PROTECTION ASIA SUMMIT 2020
1
Kannan Subbiah
Sr. VP & Chief Technology Officer
MF Utilities India Pvt Ltd
Overview
2
Who is a Third
Party?
The Extended
Enterprise
Third Party
Risk is
Enterprise Risk
Selection of a Framework
3
Comprehensive but
Simple
Flexible Interoperable Reporting
Third Party
Relationship
Cycle
4
Strategy &
Planning
Due
Diligence
Contracting
Ongoing
Monitoring
Periodic Re-
evaluation
1
2
3
4
5
Relationship
Lifecycle
Exit
Focus Areas
5
1
2
3
4
5
6
7
8
9
Scope
Segmentation
Due
Diligence
Control
System
Risk
Assessments
Governance
Organization
Policy
Framework
Tools &
Data
Third Party
Risk
Management
Focus Areas
Scope & Segmentation
6
Identify Risk
Factors
Understand
Relationship
Identify
Potential
Consequences
Risk Ranking Map /
Allocate
Resources
Due Diligence
A Marathon; not a sprint
7
Questionnaire On-site Visits External
inputs
Audits Certifications
Control System
8
Operating
Environment
Controls Information &
Communication
Audits
Risk Assessments
9
Score Cards Performance &
Behaviour
On Site Audits /
Meetings
Periodic Reporting
Organization & Governance
10
Ownership Roles &
Responsibilities
Contracts &
Agreements
Coherent
Standards
Continuity
Plans
Policies, Tools & Data
11
Integrated Regional Policies Track & Monitor Automated
Workflows
Compliance Challenges
12
Decentralized
Authority
Lack of Data &
Process
Inventories
Insufficient Tools Lack of
Automation
Key Recommendations
13
Build A Cross
Functional Team
1
Be
Comprehensive
Without Being
Complex
2
Stay Agile With
Options For
Assessment &
Analysis
3
Complement
Decision Making
with Risk Based
Intelligence
4
Recover from Breach
14
Validate STOP Notify Identify
Cause
Change
Credentials
Assess
Damage
Audit
Next Steps
15
Fourth Party Integrated Approach
Leverage Automation Monitor External Factors
Thank You
CONTACT ME AT KANNAN@SKANNAN.ME
FOLLOW ME ON TWITTER:
@KANNAGOLDSUN
16

More Related Content

What's hot

Legal Entity Risk and Counter-Party Exposure April 2016
Legal Entity Risk and Counter-Party Exposure  April 2016Legal Entity Risk and Counter-Party Exposure  April 2016
Legal Entity Risk and Counter-Party Exposure April 2016
bfreeman1987
 

What's hot (20)

Trillium Software CRMUG Webinar August 6, 2013
Trillium Software CRMUG Webinar August 6, 2013Trillium Software CRMUG Webinar August 6, 2013
Trillium Software CRMUG Webinar August 6, 2013
 
Sovling data and governance august 2019
Sovling data and governance august 2019Sovling data and governance august 2019
Sovling data and governance august 2019
 
Legal Entity Risk and Counter-Party Exposure April 2016
Legal Entity Risk and Counter-Party Exposure  April 2016Legal Entity Risk and Counter-Party Exposure  April 2016
Legal Entity Risk and Counter-Party Exposure April 2016
 
Advantages of an integrated governance, risk and compliance environment
Advantages of an integrated governance, risk and compliance environmentAdvantages of an integrated governance, risk and compliance environment
Advantages of an integrated governance, risk and compliance environment
 
Comprehensive Data Governance Program
Comprehensive Data Governance ProgramComprehensive Data Governance Program
Comprehensive Data Governance Program
 
SDM Presentation V1.0
SDM Presentation V1.0SDM Presentation V1.0
SDM Presentation V1.0
 
Evolution of Records Management in Law Firms
Evolution of Records Management in Law FirmsEvolution of Records Management in Law Firms
Evolution of Records Management in Law Firms
 
Building a Strategy customers and Auditors Love
Building a Strategy customers and Auditors LoveBuilding a Strategy customers and Auditors Love
Building a Strategy customers and Auditors Love
 
Information systems
Information systemsInformation systems
Information systems
 
Harvard-Profisee | Path to Trustworthy Data Webinar Slides
Harvard-Profisee | Path to Trustworthy Data Webinar SlidesHarvard-Profisee | Path to Trustworthy Data Webinar Slides
Harvard-Profisee | Path to Trustworthy Data Webinar Slides
 
DGIQ 2018 Presentation: How to be successful in the post GDPR landscape – bui...
DGIQ 2018 Presentation: How to be successful in the post GDPR landscape – bui...DGIQ 2018 Presentation: How to be successful in the post GDPR landscape – bui...
DGIQ 2018 Presentation: How to be successful in the post GDPR landscape – bui...
 
Success by integrating risk management in data governance
Success by integrating risk management in data governanceSuccess by integrating risk management in data governance
Success by integrating risk management in data governance
 
Architecting the Framework for Compliance & Risk Management
Architecting the Framework for Compliance & Risk ManagementArchitecting the Framework for Compliance & Risk Management
Architecting the Framework for Compliance & Risk Management
 
A Lawyer, a Salesperson and the Operations Guy Walk into a Bar . . .
A Lawyer, a Salesperson and the Operations Guy Walk into a Bar . . .A Lawyer, a Salesperson and the Operations Guy Walk into a Bar . . .
A Lawyer, a Salesperson and the Operations Guy Walk into a Bar . . .
 
Article in Techsmart
Article in TechsmartArticle in Techsmart
Article in Techsmart
 
Salesforce1 data gov lunch anaheim deck
Salesforce1 data gov lunch anaheim deckSalesforce1 data gov lunch anaheim deck
Salesforce1 data gov lunch anaheim deck
 
"Making Advanced Analytics Work for You" by Dominic Barton and David Court
"Making Advanced Analytics Work for You" by Dominic Barton and David Court"Making Advanced Analytics Work for You" by Dominic Barton and David Court
"Making Advanced Analytics Work for You" by Dominic Barton and David Court
 
4 common headaches with sales compensation management
4 common headaches with sales compensation management4 common headaches with sales compensation management
4 common headaches with sales compensation management
 
Data Quality in the Banking Industry: Turning Regulatory Compliance into Busi...
Data Quality in the Banking Industry: Turning Regulatory Compliance into Busi...Data Quality in the Banking Industry: Turning Regulatory Compliance into Busi...
Data Quality in the Banking Industry: Turning Regulatory Compliance into Busi...
 
Domain Driven Analytics - The Right Analytics Approach for Telcos
Domain Driven Analytics - The Right Analytics Approach for TelcosDomain Driven Analytics - The Right Analytics Approach for Telcos
Domain Driven Analytics - The Right Analytics Approach for Telcos
 

Similar to Implementing an Effective Third-party & Vendor Risk Management Program

Vendor risk management 2013
Vendor risk management 2013Vendor risk management 2013
Vendor risk management 2013
Nidhi Gupta
 
Governance, Risk & Compliance Management Solution
Governance, Risk & Compliance Management SolutionGovernance, Risk & Compliance Management Solution
Governance, Risk & Compliance Management Solution
Rishabh Software
 
TPRM - POV Presentation Final v2
TPRM - POV Presentation Final v2 TPRM - POV Presentation Final v2
TPRM - POV Presentation Final v2
Jason Mussman
 
Compliance, Risk Management, Licensing
Compliance, Risk Management, LicensingCompliance, Risk Management, Licensing
Compliance, Risk Management, Licensing
icomply
 
Information Security Program & PCI Compliance Planning for your Business
Information Security Program & PCI Compliance Planning for your BusinessInformation Security Program & PCI Compliance Planning for your Business
Information Security Program & PCI Compliance Planning for your Business
Laura Perry
 

Similar to Implementing an Effective Third-party & Vendor Risk Management Program (20)

FSI_Third Party Risk Management_Deloitte PoV
FSI_Third Party Risk Management_Deloitte PoVFSI_Third Party Risk Management_Deloitte PoV
FSI_Third Party Risk Management_Deloitte PoV
 
project on Offshore Outsourcing
project on Offshore Outsourcingproject on Offshore Outsourcing
project on Offshore Outsourcing
 
Data analytics 2 analytics in the audit slides
Data analytics 2 analytics in the audit slides Data analytics 2 analytics in the audit slides
Data analytics 2 analytics in the audit slides
 
Vendor risk management 2013
Vendor risk management 2013Vendor risk management 2013
Vendor risk management 2013
 
Vendor risk management 2013
Vendor risk management 2013Vendor risk management 2013
Vendor risk management 2013
 
Vendor risk management 2013
Vendor risk management 2013Vendor risk management 2013
Vendor risk management 2013
 
Vendor risk management 2013
Vendor risk management 2013Vendor risk management 2013
Vendor risk management 2013
 
Data Analytics for Auditors Analysis and Monitoring
Data Analytics for Auditors Analysis and MonitoringData Analytics for Auditors Analysis and Monitoring
Data Analytics for Auditors Analysis and Monitoring
 
Governance, Risk & Compliance Management Solution
Governance, Risk & Compliance Management SolutionGovernance, Risk & Compliance Management Solution
Governance, Risk & Compliance Management Solution
 
Model i best practice evaluation worksheet for ia
Model i best practice evaluation worksheet for iaModel i best practice evaluation worksheet for ia
Model i best practice evaluation worksheet for ia
 
TPRM - POV Presentation Final v2
TPRM - POV Presentation Final v2 TPRM - POV Presentation Final v2
TPRM - POV Presentation Final v2
 
Compliance, Risk Management, Licensing
Compliance, Risk Management, LicensingCompliance, Risk Management, Licensing
Compliance, Risk Management, Licensing
 
Third-Party Risk Management: Implementing a Strategy
Third-Party Risk Management: Implementing a StrategyThird-Party Risk Management: Implementing a Strategy
Third-Party Risk Management: Implementing a Strategy
 
Information Security Program & PCI Compliance Planning for your Business
Information Security Program & PCI Compliance Planning for your BusinessInformation Security Program & PCI Compliance Planning for your Business
Information Security Program & PCI Compliance Planning for your Business
 
3600 Evaluation Matrix for Selecting the Right Outsourcing Partner
3600 Evaluation Matrix for Selecting  the Right Outsourcing Partner3600 Evaluation Matrix for Selecting  the Right Outsourcing Partner
3600 Evaluation Matrix for Selecting the Right Outsourcing Partner
 
The State of TPRM in the UK - DVV Solutions Breakfast Briefing March 2019
The State of TPRM in the UK - DVV Solutions Breakfast Briefing March 2019The State of TPRM in the UK - DVV Solutions Breakfast Briefing March 2019
The State of TPRM in the UK - DVV Solutions Breakfast Briefing March 2019
 
Scalable integrated program audit (sipa)
Scalable integrated program audit (sipa)Scalable integrated program audit (sipa)
Scalable integrated program audit (sipa)
 
6 Steps to Transition Govt ICT effectiveness
6 Steps to Transition Govt ICT effectiveness6 Steps to Transition Govt ICT effectiveness
6 Steps to Transition Govt ICT effectiveness
 
Vendor Management - Compliance Checklist Manifesto Series
Vendor Management - Compliance Checklist Manifesto SeriesVendor Management - Compliance Checklist Manifesto Series
Vendor Management - Compliance Checklist Manifesto Series
 
IT Governance - Governing IT: Do or Die?
IT Governance - Governing IT: Do or Die?IT Governance - Governing IT: Do or Die?
IT Governance - Governing IT: Do or Die?
 

More from Kannan Subbiah

More from Kannan Subbiah (7)

Disruptive Technologies – a closer look
Disruptive Technologies – a closer lookDisruptive Technologies – a closer look
Disruptive Technologies – a closer look
 
Introduction to risk management
Introduction to risk managementIntroduction to risk management
Introduction to risk management
 
Globalization & internationalization
Globalization & internationalizationGlobalization & internationalization
Globalization & internationalization
 
SaaS Challenges & Security Concerns
SaaS Challenges & Security ConcernsSaaS Challenges & Security Concerns
SaaS Challenges & Security Concerns
 
EAI Best Practices
EAI Best PracticesEAI Best Practices
EAI Best Practices
 
Cloud computing – An Overview
Cloud computing – An OverviewCloud computing – An Overview
Cloud computing – An Overview
 
Social Computing – The Promise And The Perils Final
Social Computing – The Promise And The Perils FinalSocial Computing – The Promise And The Perils Final
Social Computing – The Promise And The Perils Final
 

Recently uploaded

Recently uploaded (20)

How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
Top 10 Most Downloaded Games on Play Store in 2024
Top 10 Most Downloaded Games on Play Store in 2024Top 10 Most Downloaded Games on Play Store in 2024
Top 10 Most Downloaded Games on Play Store in 2024
 
HTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation StrategiesHTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation Strategies
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
 
Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processors
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : Uncertainty
 

Implementing an Effective Third-party & Vendor Risk Management Program