Developing a Successful GRC
Third Party Risk Management
Program by Understanding
Strategies and Industry Trends
ISACA Tokyo Chapter Seminar

February 17, 2017

Harald deRopp
Executive Director
EY Advisory & Consulting Co., Ltd.

Harald has lived in Japan for over 20 years and has been with Ernst & Young (EY) in
Japan for over 13 years performing IT audit and advisory engagements for financial
institutions.
He is the eGRC solution leader for EY Financial Services Advisory in Tokyo providing IT
GRC tool implementation and Third Party Risk Management services to financial services
clients.

Prior to joining EY, Harald worked at the Japan branch of a US insurance company
performing accounting and systems project management functions.

Page 2

AgendaPart I: Presentation►

Evolving regulatory expectations►

Third Party Risk Management (TPRM) industry perspective►

2016 EY TPRM Survey – only firm globally to produce an annual TPRM survey dedicated tofinancial services.

►

EY Third Party Risk Management (TPRM) framework overview►

Cybersecurity and Enterprise Resilience and Recovery►

Protecting the enterprise – TPRM

Part II: Panel Discussion

Page 3

Evolving regulatory expectations

Page 4

Evolving regulatory expectations
Firms are facing a new regulatory environment
Regulatory landscape has changed significantly►

Firms face a wide range of regulatory change globally. This creates practical challenges in implementation, and mandated
timescales can result in tactical or short-term solutions.

►

Enhanced risk governance requirements are routinely cited in new regulations or supervisory examinations withsignificant focus on IT Security, Cyber, Enterprise resilience related to third party providers.

►

The direction that many national regulators are taking has significantly increased the challenges and costs of operating a
global or regional business and has a direct impact on risk governance.

Focus on remediation►

Regulatory fines and costly remediation.
programs are at an unprecedented level.

►

This is having a longer-term impact on
business models.

Revenue and cost pressure►

There is a direct impact on revenues andbusiness models, including exiting businesslines.

►

New regulation means operating to higher
standards at significant cost.

New business models require a new approach to risk governance

Page 5►

Firms will be operating in a new environment with a greater cost of regulation. As a result, many firms are transitioning
to simpler and less global business models.

►Regulators are applying leading expectations regardless of relative size and scale.

►

Investors are demanding sustainable returns and are applying pressure on costs.

►

Risk governance needs to be forward-looking and influence strategic decisions and not just deal with the consequencesof them.

Evolving regulatory expectations
Third Party Risk focus broadens
2008

2013

FDIC: FIL-442008: Guidance
for Managing
Third-Party Risk

FRB Bulletin SR
13-19 / CA 13-21: –Guidance on
Managing
Outsourcing Risk

2012
CFPB Bulletin 201203 and 2012-07:
Service Providers

OCC Bulletin 201329: Third-Party
Relationships: Risk
Management
Guidance

2015
2014
FDIC revised
Compliance
Examination
Manual Section VII.
Abusive Practices,
including VII 4.1 –Third Party Risk

FFIEC - Appendix
J: Strengthening
the Resilience of
Outsourced
Technology
Services
NY DFS: Update
on Cyber Security
in the Banking
Sector: Third Party
Service Providers

2016
SEC’s National Exam
Program (“NEP”)
included IT Security /Cyber as an examination
priority for 2016; inclusiveof Third Party oversight
FDIC, OCC and FRB
announce enhanced cyberrisk management
standards for financial
instiutons in an Advance
Notice of Proposed
Rulemaking (ANPR)

Key regulatory bodies:
FederalFinancial
Institutions
Examination
Council(FFIEC)*
Federal Reserve
Board (FRB)
Federal Deposit
Insurance
Company (FDIC)

Office of theComptrollerof theCurrency(OCC)

Consumer
Financial
Protection
Bureau(CFPB)

Security andExchange
Commision (SEC)NY Department of
Financial
Services(NY DFS)…

* The FFIEC is a formal U.S. government interagency body that includes five banking
regulators – FRB, FDIC, OCC, CFPB and the National Credit Union Administration (NCUA).

Page 6

Increasing regulatory / industry focus on
IT Security / Cyber and Resilience /Recovery in connection to third parties.

TPRM industry perspective

Page 7

EY Third Party Risk Management survey – 2016
Overview
 EY’s financial services industry survey of Third Party Risk Management (TPRM)
 2016 was the 5th year of the survey and 49 global financial services organizations participated.
 Participants receive a breakdown of their survey results with a comparison to their peers forbenchmarking purposes.
 2017 survey is now underway. A new non-financial services industry survey has been added.

Survey Focus Areas
1.
Third Party Population2.
Operating Model
3.
Critical Third Parties
4.
Assessment Framework5.
Termination / Exit
Strategies
6.
Oversight andGovernance; Quality
Assurance / Quality
Control
7.
Regulatory Exams
8.
Technology
9.
Inbound TPRM
10. Industry Outlook
Page 8

EY Third Party Risk Management survey – 2016
Summary of Key Findings

39%

43%

41%

of organizations said all of
their third parties fall within
the scope of their TPRM
program – up from 19% in ’14.
86% use 3 and 5 risk tiers.

of organizations reported
critical third parties to theboard – up from 26% in ’14.
Only 31% report third party
breaches to the board.

of organizations said primaryownership of the TPRM
function falls withinprocurement (first line ofdefense) – up from 26% in ’14.

80%

71%

75%

of organizations reported they
spend two days or less onsite when conducting
information security andbusiness resilience reviews.

71%

of firms were either neutral orface challenges withbusiness unit support in
executing program
requirements.

of firms find SOC2 reports
useful in reducing the need toperform a review – up from
52% in ’14; while 74% conduct
regulatory compliance reviews
pre-contract.

90%

of respondents felt neutral /negative about TPRM tool
integration and ability tocapture the overall risk forreporting – 49% require 1+
weeks to pull reports.

of organizations rely on third
parties to manage / evaluate
fourth parties through control
assessments or contract terms– up from 36% in ’14.

44%

of ranked enterprise-critical
third parties top regulatory
review focus, matched byoversight / governance 44%,and information security /enterprise resilience 38%.

Population andgovernance

Assessment
framework

Industry /regulatory
outlookLack of knowledge across business functions and a pervasiveness of disintegration across third-party
management tools were noted as significant barriers to greater progress…
Page 9

Population
andgovernanceA closer look at the Numbers

39% of organizations said all of their third parties fall in scope of their TPRM program
Proportion of third parties in scope for risk

Q5. What percentage of third parties are in-scope for your organization’s risk management program?
►More firms
are doingrisk
monitoringof all of their
third parties.

10%
22%

41% to 60%

4%6%61% to 80%

6%6%81% to 99%

2%0%

All third parties
require some formof risk assessment

Notes:
 2016 survey was
performed October December 2015.
 2015, 2014 and 2013 in
the legends refer to the2016 2015, and 2014
surveys respectively.

25%
31%

10% to 25%

26% to 40%

Page 1014%
16%

Less than 10%

39%
19%

2015 (49)2014 (32)indicates upward trend
from the Previous Year
(PY)
indicates downward
trend from the Previous
Year (PY)
indicates no change inthe trend from thePrevious Year (PY)Population
andgovernanceA closer look at the Numbers

73% of organizations have less than 10,000 vendors
Third-party inventory

Q4. Approximately how many third parties are within your organization’s inventory/population?
►

Firms arereducing thenumber of
their third
party vendors

73%
Less than 10,000

58%
49%
21%
21%
29%

10,000 to 29,999

30,000 to 49,999

6%
9%
14%
0%

50,000 to 69,999

Page 1112%
9%2015 (48)2014 (34)Population
andgovernanceA closer look at the Numbers

86% of organizations use 3 to 5 risk tiers
Levels of risk tiers to segment third parties

Q6. How many levels of risk or tiers are used to segment third parties within your organization’s program?
►

Firms aregoing beyond
the traditional“High” ,“Medium”,“Low” risktiers tosegment
their third
parties.

Fewer than 3

3 levels

25%
31%
43%

4 levels

39%
36%
31%

5 levelsMore than 5

Page 12

12%
11%
6%

22%
17%
14%
2%
6%
6%

2015 (49)2014 (36)2013 (35)A closer look at the Numbers

33% of organizations have 20 or fewer critical third parties

Population
andgovernance

Number of critical third parties
Q8. How many critical third parties are within the organization’s third-party inventory?
►►

Almost all
firms (93%)
keep aninventory ofcritical third
parties.
Firms arereducing thenumber of
their critical
third parties.
83% have 80
critical third
parties or
less.

20 or fewer

24%

21 to 40

42%
38%

41 to 60

13%
10%
14%

61 to 80

13%
7%
3%

81 to 100

4%
10%
7%

More than 100

Page 13

33%
16%
21%

13%
16%
17%

2015 (46)2014 (31)2013 (29)A closer look at the Numbers

43% of organizations reported critical third parties to the board

Population
andgovernance

Additional actions applied for critical third parties
Q10. What additional actions are applied, outside of standard management activities, for your critical
third parties? Please select all that apply.
►►

DirectAdditional oversight andreporting ofgovernance requirements
critical third
parties toIncreased scope of review
Boards has
activities
increasedfrom PY 26%
Increased frequency of review
activities
Most firms
apply
Direct reporting to executive
additional
management/board
oversight andgovernance,
Dedicated FTE to manage theandoverall relationship and…
increased
Board-level approval of contract
scope andterms
frequency ofreview for
No additional actions; monitoring
critical thirdsame as highest rankparties.

Page 14

81%

75%
75%
43%
36%
21%
11%

Total (47)A closer look at the Numbers

41% of organizations said primary ownership of TPRM is with Procurement

Population
andgovernancePrimary ownership of TPRM function
Q11. What area has primary ownership of the third-party risk management function?
►►

At most firms
TPRM isprimarily
owned byeither
Procurement
or
Operational& EnterpriseRisk.
In PY, only
26% said
Procurement
was theprimary
owner.

Structure of TPRM program (42)
7%
14%

41%

38%
Procurement
Operational & Enterprise Risk
Information Security
Tech & Operations

Page 15

A closer look at the Numbers

Assessment
framework

80% of organizations said they spend two days or less for on-site reviews
Duration of on-site reviews
Q21. When conducting an on-site review at a third-party site, what is the typical duration of the site
visit for each of the following components of the review (excluding travel)?
►►

Most firms
spend twodays or lessfor on-site
reviews of
their vendors
which isunchanged
from the PY.
However, fullday or lessthan half day
on-site visits
are morecommon.

Regulatory compliancereview (46)2%Business continuity
review (46)

37%

9%

23%
Information security
review (47)

26%

6%
2%

18%
Combined IS/BC/RC
review (44)Page 16

2%
0%

54%

20%
13%
11%

7%

14%

27%
34%

52%

43%
Less than half-day
Full dayTwo days
Three days
More than three days

A closer look at the Numbers

Assessment
framework

71% of organizations rely on SOC2 reports to reduce the need to perform reviews of controls
Usefulness of reports in reducing need for control assessment
Q24. On a 5 point scale, with 1 – not at all useful and 5 – extremely useful, when considering the needto perform a control review, which of the reports listed below are the most useful in reducing or
removing the need to perform a review on a third party?
►►

Most firms(71%) seeServiceOrganization
Control 2(SOC 2)
Reports as a
useful way to
reduce theneed forcontrol selfassessments
An increase
from 52% offirms in PY..

SOC 2 (44)

46%

30%

Shared Assessments
SIG (42)26%

PCI Certification (44)

23%

25%

52%

NIST (43)

21%

23%

56%

SOC 1 or ISAE3 402
(43)

21%

ISO Certification (44)14%

Shared Assessments
AUP (40)

13%

31%

37%

32%

43%

42%

55%

40%
UsefulPage 17

25%

48%
NeutralNot usefulA closer look at the Numbers

Assessment
framework

71% conduct regulatory compliance reviews pre-contract
Conducting regulatory compliance reviews
Q29. When are regulatory compliance reviews conducted? Please select all that apply.

►►

Most firms(71%)
conduct
regulatory
contract
reviews
beforecontractingwith third
parties
An increase
from 47% offirms in PY.

71%

Pre-contract
27%

57%

Post-contract49%

Not performed

4%
16%

Not applicable

10%
20%

Page 18

Compliance control assessments
Individual transactional assessments

A closer look at the Numbers

Assessment
framework

75% of organizations rely on third parties to manage / evaluate fourth parties
Assessing & monitoring fourth parties
Q31. How does your organization assess/monitor fourth parties?
Please select all that apply.
►►

Most firms
Rely on the controls at the(75%) rely on
third party to actively monitor
the controls
the fourth party
at the third
party tomonitor the
Rely on contractual terms
fourth party
established with the third party
It’s lessacceptable torely onRely on contractual terms
contractual
between the third party and theterms
fourth party organization
between therdth
3 and 4
parties or
Rely on the relationshiprelationshipmanager program
manager
programs

75%
36%

73%
(na)

56%
84%

8%
56%

2015 (48)2014 (25)Page 19

A closer look at the Numbers

71%

Industry /regulatory
outlookof organizations were either neutral or faced challenges with business unit support

Challenges
Q20. On a 5-point scale, with 1 – no difficulty and 5 – significant difficulty, what degree of difficulty does yourorganization face in addressing each of these potential challenges to your third-party risk management program?
►►Business unit
Utilizing a tool to assist in the
support for
execution of the assessment program
third party
Appropriate skillset/ knowledge/
assessment
experience across each of the functional…
activities
Clarity of responsibilities for third-party
continues toactivities across your organization
be aIntegration between risk management
challenge.
and the procurement process
Using a tool
Organizational change causing
and having
significant addition/change to…
persons with
Business unit support forthethird-party assessment activities
appropriate
skillset /Variability of assessment date/inability to distribute the assessments…
knowledge
andUnderstanding the scopeexperienceof the third-party service prior to…
for theApproval of material changes toactivities iscontract terms by Legal/General Counsel
also achallenge.
Page 20

25%
35%
25%

47%
41%
35%

35%

35%

41%

35%

29%

33%

43%

27%

35%

20%

63%
No difficulty

16%
Significant difficultyA closer look at the Numbers

Industry /regulatory
outlook

22% of firms use proprietary tools for their TPPM activities
Use of tools

Q45. What technology/tool does your organization use for each of the following functions?
Use of Tools (46)►►►

Firms areusing avariety oftools tomanage
TPPM
activities.
There is no
one tool thatsignificantly
excels above
the others at
all TPRM
activities.
Use ofproprietary
tools grewfrom 9% offirms in PY.

Page 21

ArcherBwise

OracleAriba

SAP

Hyperos

Proprietary

Other

Sourcing activity

7%

2%

9%

33%

7%

7%

22%

22%

Inherent risk
assessment

26%

2%

2%

2%

2%

13%

33%

17%

Contract repository

4%

2%

9%

30%

7%

0%

22%

26%

26%

2%

4%

4%

4%

11%

26%

26%

30%

2%

0%

0%

0%

13%

24%

20%

26%

7%

2%

0%

0%

9%

28%

24%

Primary third-party
inventory
Control assessment
facilitation toolIssue managementtool

A closer look at the Numbers

90%

Industry /regulatory
outlookof firms were neutral or negative about TPRM tool integration and reporting capabilities

Reporting tool integration
Q46. On a scale of 1 to 5, with 1- not at all integrated and 5 – fully integrated, how well do the above
tools integrate and capture the overall risk for reporting purposes?
►►

Most firms
are verydissatisfied
with the lackof theintegration of
TPRM tools
and theability of thetools tocapture theoverall risk
and report onit.
In the PY
firms were
lessdissatisfied.

Page 22

2014
(35)

12%

2015
(48)

11%

34%

54%

27%

Fully integrated

63%

3

Not at all integrated

A closer look at the Numbers

44%

Industry /regulatory
outlookof firms said regulators are most concerned with reviewing enterprise-critical third parties

Regulatory body review focus areas
Q41. During your organization’s most recent regulatory body review, what were the 2 to 3 most important
areas of focus?
►

Regulators’
main focus
continues tobe onenterprisecriticalparties but
oversight andgovernance,
and third
party
assessmentsforinformation
security andbusiness
continuity arealso keyfocus areas.

Enterprise-critical third parties

44%

Oversight and governance

44%

Third-party assessments: information security and business
continuity

21%

Maintenance of third-party inventory
Third-party assessments: compliance

19%

Third-party assessments: performance

19%
17%

Inherent risk assessment

15%

Onboarding activities
Issue management and/or
risk acceptance13%

Consumer protection

13%

Privacy/confidentiality

13%

Foreign-based third parties

10%

Fourth-party oversight8%

Operating models

8%

Residual risk model

Page 23

38%

6%

Total (48)Key takeaways from the EY 2016 TPRM Survey►

Review your inventory of third parties.




►

Review your third party risk tier segmentation.


►





►

Do you do risk assessments of all your vendors?
Can you do your on-site reviews more efficiently?
Do you do regulatory compliance reviews pre-contract?

What TPRM reporting do you have?
►Do you have a sufficient number of tiers?

Review your risk monitoring coverage►Is it accurate and complete?
Are there some vendors that can be eliminated?
Do you have more than 80 critical third parties?.

Do your report critical third parties to the board?

Do you know what regulations you must comply with for TPRM?
Review your management of 4th party risk
Page 24

Do you know who your 4th parties are?
Are there adequate controls at the 3rd party for them?

Key takeaways from the EY 2016 TPRM Survey►

How do you manage your TPRM program?
►Consider implementing a tool to better manage the complexity
There is no one dominant tool that can “do it all” for you.

Benchmark against your competitors

Page 25

Consider to participate in the 2017 TPRM survey to be able to compare
your firm to others in your industry.

TPRM framework

Page 26

TPRM framework
Functional components
A TPRM function is comprised of six functional components that enable efficient, consistentand enterprise-wide execution.
Oversight and governance is the component
that oversees the function to ensure that therelationships and activities are managed
effectively. This consists of the following
sub-components: reporting, issue
management and escalation, internaland external program liaison, quality
assurance and policy adherence.
The Operating Model defines
clear roles and relationships
supportive of consistent, risk
based application of all functional
enterprise-wide TPRM process.
Enterprise-wide Policy and Procedures
establish clear roles and responsibilities
for all functional owners through the executionof the end-to-end TPRM lifecycle. More maturefunctions embed service / risk management
within third party management policy / proceduresfor stream-lined integration and execution.

Technology and Data enable TPRM processes
to reduce overall function cost. Additionally,
the use of technology increases data
integrity and drive seamlessand reliable reporting.
Risk models help ensure monitoring
activities are reflective of the inherent/ residual risk associated with third
parties and their services – essential
in quantification and illustration of
TPRM program value.
Risk assessment and due diligence
are essential.to understand the third
parties control environment around
identified risks (e.g. enterprise resilience,cyber security, regulatory compliance etc.)
Monitoring is the periodic assessment andmanagement of risk and service performance relative to athird party and the services provided once a contracted.

41% of firms said primary ownership of the TPRM function falls within procurement (1st line of defense)– 2016 TPRM survey

Page 27

TPRM framework
Workflow and stakeholders
A leading TPRM program is seamlessly integrated into the overall third-party management
lifecycle, maintaining a balance between process, risk management and compliance.

Page 28

Organizational model
Sourcing
Leading financial services organizations are aligning their vendor management operating
model with enterprise-level strategy and culture. The center-led model is frequently deployed.

Low

Degree of Centralization

Decentralized Model
BU/
RegionProcure/CPO

BU/
RegionProcure/CPO

BU/
RegionCenter-Led Model
BU/
RegionBU/
RegionBU/
RegionProcure/CPO
Procure Procure Procure

Business units or regions maintaintheir own procurement functions
for most categories with somecoordination and communication
across units

Page 29HighCorp
Procurement
Procurement
Councils

Central procurement group defines
strategy, tools, and processes andcoordinates across BUs or regions byleveraging procurement councils;
transactions and some categories
managed at the BU or region level

Centralized Model

BU/
RegionBU/
RegionCorp
BU/
Region Procurement

Category
Mgmt

Central procurement organization
performs most functions—sourcing,
SRM, category management, andtransactions

Monitoring
Relationship, service and risk management
Effective relationship management accounts for the overall relationship across the enterpriseand is inclusive of performance, compliance and risk management activities.
Vendor RelationshipManagement
Vendor relationship management refers to the process of managing the vendor relationship as a whole
inclusive of all services provided to the company by the vendor across the enterprise. Effective
relationship management accounts for any changes in the business or operating environment that may
effect the relationship (i.e. market conditions, acquisitions, divestitures, personnel change or turnover) as
well as the output of service, compliance and risk management activities.

Service Management

Regulatory Compliance

Service Management is commonly
managed by the contract orrelationship owner within the lineof business. Common areas ofassessment include:

Regulatory Compliance overlaps
with Service Management and Risk
management expectations, but arealso assessed qualitatively toeffectively manage conduct risk.
Common areas of assessment
include:• Client Satisfaction• Contract Compliance• Service Level Management• Cost Management• Exit Strategy

Page 30• Policy File Reviews• Call Monitoring• Analytics

Risk Management
Risk Management may be
managed by the risk organization,
specific subject matter functions(i.e. Information Security), or thelines of business. Common areasof assessment include:• Information Security• Business Continuity• Location/Country• Financial Viability• Business Reputational Risk

Risk dimensions
Common third party risks
There are numerous aspects of risk to account for when making the decision to utilize a third
party to perform a service for your company.

Concentration Risk is the riskcreated by a lack of diversification
within an organizations third party
base.

Exit Strategy Risk is the risk that thebusiness would suffer a negative impact
should the relationship with the third party
need to be exited from and commonlyinternally controlled via a formal exit strategy.

Financial Risk is the risk that the third party
cannot continue to operate as a financially
viable entity. This may also be interpreted as
the potential for financial loss due to third
party failure or non-performance.

Reputational Risk

Service Risk is the risk that a third
party fails to meet your needs as acompany from a service delivery
perspective. Common metrics include
SLAs, scalability and overall
performance reviews.

Financial Risk

Service andConcentration Risk

Regulatory Risk is the risk that a third party fails tocomply with a required regulation, thus causing yourcompany to be out of compliance. This is commonly
the most complex risk to quantify and assess.

Information Security
Risk

Business Resilience Risk assesses
the risk of third party failure on thecontinuation of business as usual forthe organization.
Reputational Risk assesses theimpact to the organizations
reputation should an event occur
at your third party.
Country Risk assesses the risk of
doing business in a specific country
and includes legal/regulatory, geopolitical and social-economic
considerations.

Information Security Risk is the risk that anorganization’s data is lost or security iscompromised.

Assess risk(s) at the third party level for Concentration, Financial, Reputational, etc. risk, where appropriate.

Page 31

Risk models
Inherent, controls and residual risk
Risk models allow for the qualitative and quantitative assessment of risk; enabling an organization
to focus efforts on monitoring higher levels of inherent risk and manage higher levels of residual risk.
MonitorManageInherent Risk
Assessment

Control
Assessment

Segmentation
Assessment:
Segment 1
Segment 2
Segment 3

Assessment
Execution:

Risk Domain
Applicability:
Information Security
Business Criticality
Third Party Viability
Exit Strategy
Regulatory
Location

Residual Risk
Issue Management

Mature organizations are moving
towards real time management /monitoring of risks while leveraging
residual risk or control effectiveness ratings
to determine frequency of reviews as
opposed to inherent risk and transactional
events (e.g. contracting, invoicing, etc.).

Risk Treatment

Information Security
Business Criticality
Third Party Viability
Exit Strategy
Regulatorycompliance
Location

Residual Risk
Calculation
Information Security
Business Criticality
Third Party Viability
Regulatory
LocationRe-assessment
Timeframe

71% of organizations said they conduct regulatory compliance reviews pre-contract, up from 47% in 2014
– 2016 TPRM survey
Page 32

Reporting & metrics
Inherent vs. residual
Leading TPRM organizations have begun to look at the third party relationship holistically
inclusive of risk, compliance and performance factors.

49% of organization require one week or more to pull reports on third parties using specific data.
– 2016 TPRM survey
Page 33

Technology & data
Functional architecture
Functional integration of process is the first step in defining necessary technology enablement
as multiple systematic solutions may be selected for portion(s) of the end-to-end function.

Suppliers
Service (Obligations)
Relationship mgmt.

Commercial Relationships(Strategic Suppliers)

Commercial Relationships(Tactical Suppliers)

Transaction-based interactions
for Contracting

DemandRouting
Process

Requirements, NDAs, RFx,
Supplier Down-selection,
Contract Approvals, third
party onboarding etc.

Strategic Sourcing

Contracting

Buying• Assurance Docs
• TPRM
assessment
questionnaire• Issue
remediation
action plan

Regular touch points (e.g., once or twice a week depending on volume)

Pre-screen

Customers (Business Units)

Inquiries or Requisitions(Non-Catalog Items)

Budget & Accounting
Requisitions

Purchase Orders

Finance

Contracts,
Contract
Templates, Terms
library

Regular
Touchpoints
Requisitions (Catalog Items)

Procurement Ops

Requirements,
Clarifications, IRQ

Third-Party Risk Management
Control Groups

Page 34

Contract
Reviews

Legal & Compliance

List of applicable
control groupassessments

Cybersecurity and Enterprise Resilience trends

Page 35

Cybersecurity and Enterprise Resilience
Overview and third party risks
Heightened regulatory / industry focus on Information (IT) / Cyber Security and Enterprise
Resilience and Recovery in connection to third parties continues to drive the need for crossfunctional integration.

Enterprise
Resilienceand Recovery

Cyber
SecurityEnterprise Resilience and Recovery►
Focuses on protecting the enterprise and business
operations. Third-party breaches and outages continue toimpact the marketplace.
Cyber Security►
Concentrates on shielding a company's cyber / IT
vulnerabilities. Any single entity, including third parties,
can be a potential threat entry point.
Third Party Risk Management (TPRM)

Third Party
Risk
Management►►

Focuses on protecting the enterprise from potential
threats / risks related to leveraging third parties to provide
goods and / or services.
Holistic approach to understanding, managing andmitigating third party risks across risk dimensions (e.g.
Cyber, Resilience, Compliance, etc.) is key to meeting
regulatory and industry expectations.

Cyber / IT Security and Enterprise Resilience third party risk assessments topped the list of focus areas ofrecent regulatory reviews, alongside enterprise-critical third parties, oversight and governance.
– 2016 TPRM survey

Page 36

Enterprise Resilience and Recovery
Overview and third party risks
Focused on protecting the enterprise and business operations from internal and external incidents
that could impact the organizations’ ability to conduct business, meet regulatory expectations, react in a
resilient manner and recover from a third party outage or incident.

Key issues / drivers►►►

Key maturity indicators re:Third parties►

Does the organization have an
understanding of “all” third-parties
supporting the enterprise?

►

Is there a clearly defined
expectation for how to vet, select,engage and manage third-parties?

►

Is the business (e.g. business lines,
board, sr. leadership, etc.) aware ofthird-party risks and third-parties
considered critical to theorganization?

►

Has technology been integrated
across the end-to-end third-party
management value chain?

Regulatory community is increasing scrutiny /pressure on FSO environments to enable
operations for 30+ business days in an outage.
Need to understand potential failure points andweaknesses in supporting businessapplications / technology landscape aligned tobusiness recovery targets and sequencing.
Third-party breaches and outages continue
to impact the marketplace and expand theboundaries of the threat environment outside
the walls of the bank itself.

Page 37

Cybersecurity and Third Party Risk
Multiple threat entry points
Traditionally, organizations thought of Cybersecurity as a function to protect their own
vulnerabilities, stopping short of considering the data third parties access. Any single entity can bea potential threat entry point – causing a ripple effect across the enterprise.
Data

Cyber threats

Cyber threats
Ransomware /viruses

Pharming /Trojan horse

Affiliates /subsidiaries

Suppliers /vendors

Cyber threats

Institutional
intelligence

Data

Fraudulent /phishing emails

Cyber threats

Data

Cyber threats

Joint ventures

Malware /spywareDistribution
attacks (DDoS)

Cyber threats
Hacking /IP Theft

Data

Joint ventures

Operating in a digital world invites new challenges and threats...
►

Smart devices / services connect more networks; increasing attack surface area.

►

Social media is ‘always on’ and information widely shared, without a full appreciationof privacy and security.

►

Customers’ demand quicker updates and regulators increase security control focus.

►

Information is increasingly stored in the cloud or with third parties, resulting in lesscontrol, increased risk and a more complex cyber ecosystem.

Page 38

High-profile breaches:► 2013 Target breach involved HVAC
company with access to internal systems.
Estimated financial impact of >$250m.
► 2013 and 2015 T-Mobile customer data
breaches involved Experian lacking
adequate controls to protect consumer
information of 15 million customers.

Protecting the enterprise – TPRM

Page 39

Protecting the enterprise

Third Party Risk Management (TPRM) approach – the three A’s
We suggest that organizations adopt a 3-stage improvement process to get ahead of third party
risks across the enterprise – integrating Resilience / Recovery and Cyber / IT Security.

3) Anticipate – proactive approach
Organizations need to make efforts to predict
what is coming so they can be better prepared
for impacts on them and their third parties.

Aggregate data to predict real-time(Analyze trends across third party base and risk functions)

Implement efficient, repeatable processes
2) Adapt – build a better baseline(Leverage new technology and existing Ops, BR, Cyber / IT framework)

Organizations are constantly changing
and cyber threats / resiliency issues are
evolving: third party risk programs needto adapt to changing requirements bybuilding a better baseline.

(Develop policies / procedures to determine inherent / residual risks, identify andfocus on business critical providers, perform control assessments, etc.)

1) Activate – strong foundation
Organizations need to establish andimprove the solid foundations of their
third party risk program.

Define risk-based framework

Identify third party population(Define third party population sources, review databases – AP, Contracts, etc. and work withcounterparts across BR, Cyber / IT Security to increase identification accuracy)

Two greatest challenges facing clients are Technology and Knowledge across business functions– 2016 TPRM survey
Page 40

Protecting the enterprise

TPRM approach and Cyber Security – the three A’s defined

Anticipate– strong foundation– build a better baseline– proactive approach

Review / update security policies,
standards and procedures –including internal dataclassifications.



Know yourself►

►

Identify data classification / flows
and who accesses (e.g. third
parties).
Create risk tiers and classify third
parties based on the risk posed toyour organization.

►

►



Critical suppliers should safeguard
your data within the same risk
thresholds you maintain.

Define TPRM RACI.

Know yourself and third parties►

Just as threats evolve for yoursystems, they evolve for your third
party’s systems.
Use risk based approach todetermine assessment type anddepth (e.g. onsite vs remote).

Develop metrics►

Assess IT security controls►Enhance assessment criteria

Create your ecosystem inventory
►



Adapt

Set the expectation►



Activate►

Report on critical third party’s
performance and security to senior
management and board.
Draw the line – how much risk is too
much?

Define response to third party
breaches and understand how
they’ll involve you in incident
response.
Volume of devices with access toyour data will only increase.
►Cyber threats are evolving
constantly; in-direct threats may
impact your third parties.

Assess third parties based on criticalthreats as they emerge.

Examine risk posed by 4th parties.
►►

Assess third party’s TPRM program.
Assess the fourth party directly1.

86% of organizations use between 3

31% of organizations report third

27% of organizations do not report on

and 5 segments / tiers of third parties*

parties with breaches to the board*

third parties related to emerging risk** - Results based on 2016 EY TPRM Survey; 1 – if contractually permissible

Page 41

Protecting the enterprise

TPRM approach and Enterprise Resilience – the three A’s defined

Anticipate– strong foundation– build a better baseline– proactive approachReview / update resilience /recovery policies, standards andprocedures.

►

Determine criticality of processes
and third parties providing services
related to those processes.
Create risk tiers and classify third
parties based on the risk posed toyour organization – incorporating
criticality of processes supported by
the third party.

Assess Enterprise Resilience
controls►

Critical third parties should be held
to the same resilience thresholds(e.g. 1 hr, 24 hrs, etc.) you maintainfor the services they provide tosupport your processes.

Enhance risk inventory criteria►

Understand critical inventory
►



Adapt

Identify framework►Activate►Enhance procedures to determine
criticality of processes and related
third parties.
Use a Business Continuity Analysis
Template (BCAT) to determine if
the process / service is:- Systemic- Required / obligatory- Business critical- Business important







►

Apply risk based approach todetermine assessment type anddepth (e.g. onsite vs. remote).
Develop metrics►►

Report on Business Critical third
party’s performance and resilience
to senior management and board.
Develop a risk-appetite for yourcritical processes / third parties.

Potential impacts from your third
parties resiliency change
constantly; in-direct threats may
impact your third parties and thecritical services they provide.
Define response to BusinessCritical third party failures andunderstand how they’ll involve you
in incident response.
Examine risk posed by 4th parties.

►

Assess third party’s TPRM
program; specifically their focus onresilience of their third parties.
Assess the fourth party directly, if
contractually permissible.

Increase governance andoversight of third parties
providing Business Criticalservices – understand their blindspots / issues.

Enterprise Resiliency of your third parties continues to be a regulatory focus, driving the need for a proactive
approach to manage / mitigate risk of potential third party failures.

Page 42Appendix

Page 43

EY Third Party Risk Management survey
Market trends and survey details
In the winter of 2015, Ernst & Young surveyed 49 global institutions with a vendor risk function in the retailand commercial banking, investment banking, insurance and asset management sectors.
Key findings from Ernst & Young’s 2016 Supplier Risk Management Survey
Third-Party
Population•

39% of organizations communicated that less than 25% of the organizations third-party population are in scope for theorganization’s risk management program, which is a significant increase from the 10-15% of the population that has
been a staple data point over the last 3 years.
 39% said all which is a strong indication that organizations are continuing to revisit the third party population to reprofile.

Operating Model

Page 44•86% of organizations use between 3 and 5 segments/tiers•

83% of organizations have a critical third-party list that is 80 third-parties or less; this has been observed
regardless of the size of the organization or third-party population.

•

85% of organizations indicated that less than 25% of their risk assessed population posed consumer protection risk to
the organization.

•

41% of organizations indicated that primary ownership of their third-party risk management function is within
Procurement, up from 26% the year before; 26% house this within a risk function (enterprise or operationalrisk).

•

Only 14% of organizations indicated that their program is fully decentralized, showing a strong push towards hybrid(41%) and centralized (45%) models.

•

53% of organizations indicated that primary ownership of inherent risk assessments are owned within the Line ofBusiness (up from 32% last year), however we did see strong coordination with risk groups to support in conducting
this activity.

•

In looking at third-party entity level assessments such as AML, Sanctions, Reputation and Anti-bribery/corruption we
see a wide distribution between the Line of Business, TPRM and Compliance. Ownership by Compliance for a firstline activity could cause concern relative to the 3 Lines of Defense model.

•

71% of organizations were either neutral or believed they faced challenges with business unit support in theexecution of program requirements showing a continued challenge in business risk culture for third party
management.

EY Third Party Risk Management survey
Market trends and survey details (cont…)

Key findings from Ernst & Young’s 2016 Supplier Risk Management Survey
ReportingAssessment
Framework

Fourth Parties

Page 45•

31% of organizations noted that they communicate third-party data breaches to the board; 71% report this to
Senior Management.

•

43% of organizations report critical third-parties to the board level up from 26% last year.

•

80% of organizations indicated they spend two or less days on-site in conducting Information Security andBusiness Resilience reviews. Even more interesting was 74% spend a day or less onsite when conducting
regulatory compliance reviews.

•

Adoption of the Shared Assessments program as a framework went up from 24% to 28% but still trails
proprietary frameworks which are in use at 46% of organizations. We did see a strong correlation between
those who use Shared Assessments and accept a SIG or an AUP to reduce or replace assessment efforts.

•

71% of organizations feel the SSAE16 SOC 2 is useful in reducing or removing the need to perform areview on a third party, up from 52% last year.

•

71% of organizations indicated they conducted compliance control assessments pre-contract up from last
year's 58%.

•

The top three most important considerations when assessing third-party controls are protecting customer
information (84%), complying with regulations (63%), and protecting reputation and brand (43%).

•

78% of organizations indicated that they identify fourth parties within the contracting phase; 75%
also indicated they identify this within control assessment activities.

•

In evaluating fourth parties, we saw an increase from 36% to 75% of organizations that rely on the third
party's ability to manage the third party (this would include evaluating the third-parties’ TPRM program).

EY Third Party Risk Management survey
Market trends and survey details (cont…)
Key findings from Ernst & Young’s 2016 Supplier Risk Management Survey
Termination / Exit
StrategyOversight andGovernance +Quality Assurance /Quality Control

Regulatory Exams

Page 46•

74% of organizations place responsibility for the creation of exit strategies within the line of business; Almost
half of all organizations surveyed indicated they document this prior to contract execution.

•

8% of organizations do not have exit strategies as a formal part of their program, however this was highly
concentrated in organizations with less than 25k employees.

•

All of the organizations surveyed consider testing of internal compliance with program requirements,
development of program policy and procedures and reporting to senior management as a core part of theirOversight and Governance program responsibilities.

•

The ability to pull reporting within these functions, however, seemed to be a challenge with 49% oforganizations indicating it would take a week or more to pull a report of suppliers with specific criteria and
73% indicating it would take a week or more to forecast contract expiration, showing a strong data disconnect
between Procurement and TPRM systems.

•

Only 26% of organizations indicated they could run on-demand risk scorecards.

•

We continue to see minimal action around termination of suppliers for breach or failure across themarketplace.

•

In line with last year's results, we saw the top 3 focus points (in order) for regulatory reviews to beEnterprise critical third-parties, Oversight and governance, and Information Security/BusinessResilience assessments.

•

We did however, see a much wider tail on focal points across the full data set indicating that regulators arecontinuing to go wide as well as deep in their oversight activities.

For any questions related toThird Party Risk Management services or
EY’s 2017 Third-Party Risk Management Survey

Please contact :Harald deRopp, Executive Director
EY Advisory and Consulting Co., Ltd.
Mobile: 080-2083-0056
Email: harald.deropp@jp.ey.com:

Page 47

47

EY | Assurance | Tax | Transactions | Advisory
About EY
EY is a global leader in assurance, tax, transaction andadvisory services. The insights and quality services wedeliver help build trust and confidence in the capital
markets and in economies the world over. We develop
outstanding leaders who team to deliver on our promises
to all of our stakeholders. In so doing, we play a criticalrole in building a better working world for our people, for
our clients and for our communities.
EY refers to the global organization, and may refer to one
or more, of the member firms of Ernst & Young Global
Limited, each of which is a separate legal entity. Ernst &Young Global Limited, a UK company limited byguarantee, does not provide services to clients. For more
information about our organization, please visit ey.com.
© 2017 EYGM Limited.
All Rights Reserved. Proprietary and confidential. Do not
distribute without written permission.
This material has been prepared for general informational
purposes only and is not intended to be relied upon as
accounting, tax, or other professional advice. Please refer
to your advisors for specific advice.

ey.com