Vendor Risk Management is increasingly at the forefront of risk management priorities for organizations of all shapes and sizes. In the drive to focus on their core competencies, many organizations today rely on hundreds if not thousands of partners, vendors and service providers to fill non-core functions. In practice these external partners have access to much of the same data as regular employees do. Commercially sensitive and proprietary data is often transmitted, stored and processed among a wide range of partner and vendor networks, outside the influence of any one organization’s internal controls and security policies.
Regulators acknowledge the role that partner and vendor networks play, and regulations such as SOX, GLBA, HIPAA, PCI DSS and others explicitly mandate that corporate control activities extend to third-party vendors, outsourcers, contractors and consultants when appropriate. Consequently third-party vendors may handle critical information and directly influence a company's risk and compliance management process.
Limitations of Current Practices
Vendor and partner assessments are traditionally performed using questionnaires and surveys, supplemented with evidence from scanners and other security reports and on-site audits. These practices often fall short of the necessary requirements for a number of reasons, including the following:
- Manual processes scale poorly. Thousands of individual assessments may be required to guarantee compliance in many cases – email, spreadsheets and Word documents are often not standardized and have many specific limitations.
- Audits for SOX, PCI, SAS70 and other specific regulations each have their own vendor assessment requirements
- Questions and requirements in manual assessments may lack the process and clarity needed to complete a thorough and impartial assessment – especially given the sensitivities associated with risk assessment information exchanged between two organizations
- Costs associated with manually assessing offshore and geographically dispersed suppliers and service providers may negate any expected savings from working with offshore partners
How Modulo Risk Manager helps your organization with vendor risk management:
Modulo Risk Manager helps you asses vendor compliance with your organization’s policies and controls, enabling you to manage vendor risk efficiently and effectively. Modulo Risk Manager enables you to manage each of the key activities in an effective vendor management process, including risk-based vendor selection, relationship management, ongoing compliance monitoring, and flexible, effective management reporting.
- Facilitates aggregation of vendor information, including profiles, contacts, facilities, contracts and projects, in a centralized data repository
- Enables vendor relationship managers to minimize and manage risk associated with vendor relationships by tracking key performance indicators and the status of deliverables
- Facilitates consolidation of survey assessment questionnaires from different compliance teams, enabling vendor risk assessment both before and after the contract process to evaluate compliance with your organization's policies, controls and regulations
- Reduces costs by importing your own assessment questions or utilizing pre-built questions based on best-practice standards such as the Shared Assessments Standardized Information Gathering (SIG) questionnaire
- Accelerates and reduces costs of assessments by enabling vendors and vendor managers to complete their assigned assessments with no prior training, adding question-specific comments and attaching supporting evidence as needed
- Automatically scores assessments and generates findings for each incorrectly answered question, and identifies areas of non-compliance with your organization’s policies and controls;
- Provides effective assessment of the status of each finding, including the vendor response and appropriate mitigation procedures, thereby facilitating tracking of remediation tasks
- Provides risk transparency and visibility into high-risk areas or your business, the status of ongoing vendor assessments and your organization’s overall risk exposure
- Generates effective reports for analyzing your vendor risk profile, and allows creation of ad-hoc reports and dashboards with drill-down capabilities
- Helps you create a win-win relationship with suppliers, with a shared understanding of goals, helping both parties cost-effectively achieve and sustain compliance
