TPRM Forum’s recent survey of TPRM leaders identified effective collaboration of FLOD operations with Vendor Management, Strategic Sourcing and Procurement as the leading area of focus for improvement. Alignment across the cross-functional teams has the potential to achieve comprehensive vendor life cycle management and evidence support. The issue though is how to centralize and coordinate activity.

Looking specifically at the ‘monitoring’ phase of Third Party Risk & Vendor Management, we quickly see there are a number of activities, if coordinated and managed centrally, will provide regulators and audit the evidence required to substantiate effective TPRM operations. It also drives a productive level of collaboration and in essence, bonds the teams.

Third Part Risk Management ‘Monitoring’ Life Cycle Phase includes, but is not limited to, the following activities:

• Vendor Management Organization:
  • Contract Management – collection and maintenance of the Deliverable & Obligation tracker with a structured, formal calendar of events. Artifacts stored in central, accessible location. This could include annual Insurance certificate, SOC II Type II Audit, DR Annual Test Results, Policy revisions etc.
  • 4th Party Management – definition and approval of 4^th party sub-contractors and execution of proper onboarding and offboarding by the Third Party
  • Performance Management – SLA & KPI’s associated with the contracted services
  • Operational Service Management – onsite assessments of the technology services aligned to CMMi, ITIL, NIST or similar independent methodology

• Third Party Risk Management – FLOD:
  • Inventory maintenance
  • Third Party Classification
  • Ongoing, dynamic monitoring (Business dimensions)
  • RCSA management &/or coordination
  • Concentration identification
  • Regulatory environment changes and Legal Impacts
  • Regulator response support
  • Centralized reporting/vendor profile

• Strategic Sourcing:
  • Contract Currency – Revision and Amendment Maintenance

TPRM Forum recommends consistent, ongoing collaborative sessions between parties to ensure activities and schedules are maintained and a central, accessible repository is continually updated. This is a great opportunity to work with your GRC platform team to ensure activities and artifact collection is incorporated into workflow with artifacts accessible through a central dashboard.