TPRM-VMO: A Single Team Mindset

pexels-photo-262524.jpegIn a recent survey conducted by the Technology TPRM Forum, Third Party Risk leaders indicated a growing focus on establishing strong partnerships with internal vendor management teams. This was identified as the top action with the intended benefit being able to more effectively support business demand.


While the value of an aligned VMO-FLOD is clear, reality of establishing the needed collaboration remains elusive.

  • Vendor Management teams must become more aware of risk as a necessary dimension to incorporate in their operations and not view FLOD representatives as an extension of internal audit.
  • FLOD team members must bring value, enabling the VMO to meet business demands with risks assessment and monitoring integrated into operational process.
  • VMO must see value – FLOD must establish credibility.

Essentially an environment of trust and an appreciation for one others perspective is required to pull the team together.  Without this foundation, no level of effort will yield the necessary results. FLOD will take on more of an oversight function, impacting SLOD effectiveness and ultimately lessening the contribution of audit.

The Technology TPRM Forum intends to conduct a follow-up survey among TPRM and VMO leaders to identify specific best practices being leveraged today to form a strong, productive VMO/TPRM bond.

ORM Leaders: Seize Control of Digital Transformation

pexels-photo-931911.jpegAs Operational Risk Management (ORM) leaders are rapidly establishing dedicated Technology Third Party Risk Management organizations, they are being challenged by their executives to address the accelerated pace of Digital Transformation. The need is to establish process, procedures, terms and assessments necessary to effectively assess risk of digital technology adoption, such as FinTech, while satisfying regulator expectations.

To be truly effective, Enterprise and Operational Risk leaders must seize the opportunity to establish themselves as strategic facilitator of the digital agenda. By doing so, ORM leaders reduce the strain on their organizations and enable improved focus and execution. Consider these steps to enable a comprehensive and effective Digital TPRM program.

1.       Facilitate a focused Digital Transformation dialogue across leadership

  • Include Corporate Executives, Business, Product, Procurement, Audit, Technology leaders to establish a common vision.
  • Get clarity – move beyond technology to specific third parties in each area of category

2.       Bring this detailed message to the operational leaders in each functional area.

  • Drive alignment between executive vision and operational execution
  • Challenge third party non-conformance

3.       Clarify ‘risk must-haves’ for third parties to establish Minimum Viable Risk (MVR) tolerance

4.       Establish process by which third parties are engaged with defined roles and responsibilities

5.       Create frequent reporting to enhance transparency, status, gaps and corrective measures

Creating a dedicated Digital TPRM program separate from or a sub-set of the Technology TPRM will create the focus necessary for ORM leaders to meet accelerating business time expectations with identified risk.

Welcome to Technology TPRM Forum

Technology has become a critical, cross-functional element for every comprehensive Operational Risk Management program. The drive for financial organizations and banks to rapidly adopt FinTech and other emerging technologies while satisfying the requirements of regulators has placed effective risk management of the technology portfolio center stage.

The mission of the Technology TPRM Forum is to create an environment for the open exchange of information and experience to support creation of best practices.  We will support this dynamic thru the creation of targeted research, sharing interviews with Enterprise, Operational and Technology risk leaders and our unfiltered observations.

Please join us in making the Technology TPRM Forum a productive setting that produces community benefit.pexels-photo-59197.jpeg

‘Common Grounds’

blur business coffee commerce
Photo by Pixabay on

Vendor Management Organizations (VMO) and First Line of Defense (FLOD) third party risk teams struggle to achieve effective collaboration. Contributors to this challenge is VMO and FLOD risk professionals see situations from different perspectives and speak a slightly different language. These dynamic impacts the ability for VMO’s to achieve the maturity necessary to deliver value while limiting the FLOD’s risk effectiveness.

The TPRM Forum recommends VMO and FLOD leaders focus on the following areas to establish ‘Common Ground’.

  1. Vendor Categorization:
    • Mature VMO’s establish vendor classifications to drive innovation and identify emerging technologies to support the road map
    • FLOD and TPRM organizations categorize third parties to develop appropriate strategies based on risk dimensions
    • Making this a collaborative partnership enables VMO’s and FLOD/TPRM teams to support one another while establishing a more comprehensive strategic view of risk
  2. Contract Currency:
    • FLOD and TPRM teams continually monitor regulatory bulletins and guidance to identify potential impact to evidence and compliance requirements.
    • VMO’s continually strive to ensure Terms & Conditions, KPI’s and service definitions are driving the desired behavior.
    • Working in unison with Procurement and legal, VMO’s and FLOD/TPRM can continually focus revisions and updates to maintain contract currency
  3. Partner Monitoring:
    • VMO’s focus on continuing improvement (CI) and achieving greater savings and performance.
    • FLOD/TPRM teams focus on monitoring compliance and adherence to stated requirements
    • Working together, understanding one another’s monitoring focus and activities while sharing details of assessment activities provides additional data points.

The TPRM Forum’s PULSE Assessment provides an excellent foundation to forge a strong alignment of VMO and FLOD teams to support business expectations and manage risk exposure.

Software Asset Management – Audit Susceptibility

CoverSusceptibility is defined as ‘the state or fact of being likely or liable to be influenced or harmed by a particular thing’.

In the case of a software audit, Susceptibility is the likely severity, disruption and extent of financial exposure a firm may experience in the event a software publisher issues an audit notice. Negotiating the reduction or elimination of software audit findings, while valuable, is NOT Software Asset Management.

Effective SAM requires careful orchestration, monitoring and entitlement management. SAM encompasses successful alignment of policy, procedures, controls, procurement, IT and PMO processes with rapid infraction identification. Properly executed, SAM not only minimizes audit exposure, it delivers efficiency of software investment.

Like regulators such as the OCC, CFPB and others examining compliance, software publishers produce significant Third Party Risk exposure requiring proactive and dynamic management. The TPRM Forum is pleased to share the introduction of the Audit Susceptibility Index assessment designed to help SAM operations identify the actions and tactics to mature their operations and establish enhanced productivity and efficiency.

For additional information on how we can support your SAM needs, please use the CONTACT page.

When did TPRM become a Tool-Centric Discussion?

TPRM DecomposedThe Third Party Risk Management community is dominated by content focused on GRC and TPRM technology tools. White papers, research reports, web-ex presentation fill our in-box daily. Each claiming unmatched ability to solve our challenges.

What is missing from this ongoing barrage is guidance and best practices on how TPRM leaders can successfully leverage to support the other key elements of TPRM operations. Best Practices such as:

·         How TPRM leaders can effectively build organizations and operations integrated with business operations, procurement, VMO and legal.

·         How the tool can enable quick, accurate and dynamic monitoring combined with the other activities such as RCSA’s and contract triggers to provide a single risk view.

·         How do we establish rapid, ‘fast-track’ risk processes to meet business expectation

·         How to integrate existing tools to maximize investment

TPRM leaders understand the importance of the TPRM platform, but it is an enabler, not the complete required solution. Let’s build on this foundation and expand the discussion to encompass a comprehensive TPRM solution!

TPRM Survey Respondent Profile


Thank you to the 114 risk professionals who completed the survey on the impact of Digital Transformation on TPRM operations. The survey is now closed and we have initiated analysis of the results but wanted to share the typical profile or average demographics of the respondent.

Respondents to the survey are:

  • Members of their TPRM organization
  • Work in the banking and capital market segment
  • On average, have $100 billion assets under management
  • Is being impacted by digital transformation
  • Cloud is the leading digital technology impacting operations
  • Primary operational focus is accelerating support of business operations
  • Most concerned about identifying 4th and 5th parties for business continuity
  • Believes regulators will increasingly focus on capacity and concentration of third parties

We will release final survey results and analysis next week!