Third-Party Risk Management

A mature TPRM approach is more than a checklist. It is a cyclical process, from intake to controlled offboarding. Here are the six key steps:

1. Strategic intake: determine your risk landscape

You start with an overview. Which external parties do you work with? What exactly do they deliver? And how critical are they to your business operations?

Standard practices:

• Make an inventory of all current suppliers (IT, HR, operations, etc.) and partners in the supply chain;
• Use Inherent Risk Questionnaires (IRQs) to classify suppliers based on business impact, dependency and data access;
• The outcome of this also determines the risk tier and the difference in approach between low, medium and high-risk vendors.

2. Risk assessment: identify vulnerabilities

Assess the potential risks for each supplier in terms of security, compliance, stability and reputational damage.

Standard practices:

• Use the results of the IRQ and risk tiering: high risks receive more in-depth assessments.
• Request statements, certifications and ratings:
  • ISAE-3000/3402 statement;
  • ISO-9001/14001/27001/42001 certificering;
  • Rainforest Alliance or FairTrade certifications;
  • EcoVadis or BitSight rating;
  •  
• For other risks that are not or insufficiently covered by statements or certifications, questionnaires are sent to the supplier based on known (industry or sector) standards:
  • ISO 27001 (information security);
  • NIST SP 800-53 (cybersecurity);
  • GDPR (privacy);
  • GRI, SDG, UN Global Compact (sustainability);
  • CDP (environment);
  • DORA, PCI-DSS (financial).

3. Risk management & contracting: convert agreements into protection

Limit risks by taking (joint) measures and setting them out in contracts. This makes compliance and risk management enforceable.

Standard practices:

• Depending on the type of service, set requirements for cyber security and resilience, human rights and privacy, environment and surroundings, good governance, etc.;
• Lay down contractually: SLAs, DPAs, audit rights, exit clauses;
• Develop concrete improvement plans with deadlines.
• Don’t just impose requirements, but advise, support and invest in companies in the supply chain to achieve these objectives. This may sound counterintuitive, but a healthy supply chain is good for people, the environment and operations.

4. Implementation & onboarding: safe and pleasant collaboration from day one

Ensure a smooth and secure start to the collaboration, with clear agreements and controlled access.

Standard practices:

• Use an onboarding checklist with technical and legal requirements;
• Implement the ‘least privilege principle’ for access to systems;
• Verify the necessary background checks for personnel;
• Have suppliers sign all relevant policy documents and explicitly review the zero tolerance policy, e.g. with regard to sexual harassment, human rights, environmental offences, theft and fraud;
• Review relevant safety requirements, code of conduct and procedures;
• Ensure a pleasant and respectful working atmosphere;

5. Continuous monitoring: remain alert to changes

Risks are dynamic. New threats, incidents or changes at suppliers must be quickly identified.

Standard practices:

• Monitor for data breaches, vulnerabilities, acquisitions or compliance violations;
• Use real-time alerts, external risk data (e.g. via EcoVadis) and local news (e.g. regarding human rights violations and environmental offences);
• Exercise the right to audit through on-site visits or audits carried out by third parties , e.g. regarding the situation in the workplace, ISAE statements, ISO 27001 information security and cybersecurity, ISO 9001 process control, Rainforest Alliance certification, etc.;
• Schedule annual or semi-annual reassessments for critical suppliers;
• Discuss ESG performance and involve relevant stakeholders in improvement processes;
• Keep talking to each other, learn from each other and respect each other’s interests. This will create a long-term relationship that delivers value for all parties in the supply chain and has a positive impact on people and the environment.

6. Exit & offboarding: close relationships securely

Terminate relationships in a controlled manner and prevent access, data or systems from remaining open unnecessarily.

Standard practices:

• Conduct a contract review covering termination clauses, remaining obligations and SLAs;
• Terminate access via Identity and Access Management (IAM) systems, rotate digital keys to which the supplier had access and terminate physical access by collecting/deactivating access passes;
• Verify that sensitive data is deleted and laptops and tokens are returned, and that intellectual property agreements are implemented;
• Execute transition to any new parties. In cases of high dependency or interdependence in business processes, disentangling and phasing out may be a project in itself;
• Formalise the departure and communicate this widely, both to express gratitude for the collaboration and to make it clear that the supplier is no longer involved.
• Document the entire exit process for audit and compliance purposes.