How is COVID-19 changing third party risk management?

In this blog we highlight the changes we have seen and where our predictions have begun to ring true:

• We predicted that organisations would become increasingly concerned about the rising cost of getting third-party risk management wrong – a reflection of the growing dependence on critical third-party relationships. We have witnessed clients make a huge effort to ensure continuity and resilience of their critical third parties. This is in addition to seeing them face increased pressure to operate as a responsible business. Organisations are more focused than ever on the safety and well-being of third parties they work with.
• We have seen tangible investments in resources, capabilities, technology and reporting to monitor critical third parties, despite cash constraints. Cost and revenue recovery initiatives are increasingly being used to fund this additional investment. We predicted that a growing appreciation of the potential damage caused by third party failures throughout the COVID-19 pandemic would increase leadership attention on the value of TPRM, this investment suggests it has.
• Third party risk management expectations continue to evolve. The pandemic has highlighted shortcomings in some organisations such as poor visibility of critical third party relationships or key contractual terms. Organisations that learn during the pandemic and evolve their TPRM frameworks accordingly will leave their peers behind.
• Many organisations are acquiring ready-made risk intelligence from external sources and consultants, rather than building deep in-house expertise, to improve their TPRM frameworks. The trend was already shown in this year’s survey: organisations use third parties for managed services and utility models, and to buy in domain-specific feeder technologies, subject to financial constraints.
• Technology will be at the heart of finance and controls transformation initiatives. COVID-19 has strengthened the desire for better visualisation of data and online alerts to enable action and make top-level reporting more succinct and smarter. During the pandemic we’ve seen many organisations realise the need to identify and visualise third party delivery locations, as mapping headquarter locations did not always identify the right level of geopolitical risk exposure.
• Finally, although insourcing some third-party processes initially appeared an attractive option to regain control during the pandemic, organisations are realising that insourcing must be balanced against the associated costs – such as developing relevant in-house capability – at a time when cash reserves must be protected.

Read more about our predictions on how third party risk management could change in our report: Be responsible and effective: Strike a balance. To discuss any of the TPRM developments discussed in this blog, contact one of our authors.