The adage “A chain is only as strong as its weakest link” highlights the importance of addressing third-party risk, specifically supplier risk. It suggests that even a well-integrated process or team can fail if one component is weak, emphasizing the need for strength in all aspects.
The analogy shifts when the weakest link in a chain is not the last link anymore, but either the first or a middle link. In this case, the weak link becomes the risk itself, rather than a tool for managing it. When dealing with suppliers, it is crucial for every link in the supplier arrangement to be strong, as any weakness could lead to the failure of the entire process or system. To achieve this, it is advisable to focus on strengthening each link during the Contract and Onboard stage of the Third-Party Lifecycle.
In the following blog, we will explore effective techniques and methods for handling risk during the process of negotiating supplier contracts and integrating suppliers into a company’s relevant third-party management protocols.
In the context of our conversation, although there may be some overlap in the implementation of risk management strategies among several types of third parties that address shared risk exposures, this blog will center on the risk management of arrangements with suppliers and service providers, focusing on the most significant or impactful risks.
The success of the Contract stage in the Third-Party Lifecycle model relies heavily on effectively completing the Plan, Evaluate, and Select stage. These stages require a significant investment of time and resources to ensure that the resulting contract includes essential liability clauses, service level agreements, monitoring and reporting mechanisms, and governance structures that address all potential risks associated with the supplier’s services and their own risk landscape.
During the contract creation process, it is crucial to keep in mind the potential need for collaboration with the supplier to improve their risk management approach.
This proactive approach will minimize any adverse impacts on your company’s strategy, operations, finances, and customer satisfaction caused by the supplier’s risks. Understanding the possible tangible and intangible consequences is important when determining the necessary specifications for the supplier to address any damages that may arise during the Evaluation phase. Including adequate limits of liability and indemnification clauses in the contract is essential for protecting against such outcomes.
A well-designed program focused on managing supplier risks can also assist your company’s negotiators in securing solid liability protections from the supplier. However, agreeing to higher liability limits or greater indemnification is essentially the supplier giving up their own protection if they already have sufficient safeguards in place through their own processes and systems. It should be noted that if the supplier relies heavily on contractual liability limits rather than process or system protections, this may indicate a risky choice for your company.
Obtaining services from suppliers does not release the contracting company from their responsibility for outsourced tasks. This means the company cannot fully transfer the risk to the supplier, particularly when monitoring their performance throughout the contract period. As a result, companies prioritize the potential risk of harm that may arise from supplier arrangements. Therefore, the guidelines for managing supplier risk must include the company’s policies and control standards in the supplier agreement. nt.
These guidelines should be based on the initial risk assessment conducted during the Plan, Evaluate, and Select phase. However, any remaining risk, such as an elevated level of inherent risk in activities like cyber security, fraud, or money-laundering, should not dictate the risk management standards in the contract. It is crucial for companies to carefully consider the trade-offs involved in the contract, as it presents both potential risks and benefits for the supplier.
Companies must also acknowledge that the reliability and security of the supplier to their company heavily relies on their ability to generate sufficient revenue from the specified service in the contract. However, the methods used by the supplier to generate this revenue may hinder or even prevent the company from receiving full protection and compensation in case of any harm.
Asking the supplier to tailor risk management plans specifically for your company could potentially lead to additional costs. During the Plan, Evaluate and Select stage, it is important for the company to conduct due diligence on the supplier’s approach to outsourced services and their risk mitigation methods for configuring the service or creating the underlying system. This information can then be considered when determining the company’s risk tolerance.
As your company is responsible for the risk involved in the supplier agreement, it is necessary for your company to incorporate suitable governance measures in the contract to effectively manage and oversee the suppliers. This will ensure that any changes in the supplier’s performance and health, which may impact on their risk profile, are promptly brought to your company’s attention. This approach empowers your company to maintain a balanced supplier risk profile in line with your company’s risk tolerance.
The sustainability of the supplier’s performance in the partnership is highly dependent on the effectiveness of both your company and the supplier in mitigating risks. As risk significantly impacts performance, it is crucial for the supplier contract to include a provision for suppliers to submit risk reports using a combination of leading and lagging metrics. This is especially important if these metrics are already being used by the supplier internally.
The risk metrics will be derived from comprehending the results of controls due diligence conducted during the Evaluate phase. Suppliers who regularly serve the customer’s industry should have established reporting systems, whereas suppliers new to the customer’s segment should anticipate investing in monitoring and reporting infrastructure that meets industry norms and regulatory obligations. This ensures the supplier can maintain a competitive offering in the market.
It is typical for businesses to require their suppliers to adhere to their established control protocols. In the event of a supplier’s failure, whether financially or in their performance, incorporating the supplier’s agreement to the company’s control standards into the contract will ensure that the supplier is held accountable to maintain the current standard of controls. The implementation of a two-tier risk and control structure is put in place, which entails both direct monitoring and reporting of suppliers, as well as company oversight to ensure adherence to uniform benchmarks across all supplier arrangements. The contract for supplier arrangements should also have sufficient flexibility to enable the company to periodically update control standards in response to the natural evolution of services over time.
Furthermore, if a risk emerges and could potentially cause harm to your company’s customers or threaten its stability, the contract should include provisions for information sharing. These provisions should be in line with your company’s corporate governance framework and specify the timeline for the supplier to report and address any risks. In addition, the governance should set clear thresholds for when risks should be escalated to your company. These thresholds should be based on the company’s risk appetite and tolerance levels. This means that escalations should be immediate and follow documented notification protocols.
Finally, if your company’s negotiation starts with its own contract template, any changes made to the template must be recorded and included in the final contract. In industries that are regulated, the contract should also be evaluated by relevant individuals within the company to ensure that it meets regulatory standards and effectively reduces the company’s risk in terms of liabilities, indemnification, resilience, compliance, and contingency and exit plans.
Your supplier arrangement contract must cover all stages of the Third-Party Lifecycle. Neglecting to conduct a strong and comprehensive contracting process could result in contracts not suitable for their intended purpose. This could potentially result in regulatory penalties, subpar customer service, contract violations, and a damaged relationship with the supplier.
When entering into a contract with a new supplier for goods or services that have not been obtained before, or when transitioning existing goods or services to a different supplier, it is crucial to ensure the success of the arrangement. This can be achieved by utilizing tools such as Know Your Supplier (KYS) and conducting an inherent risk assessment to identify any potential risks. Any areas of residual risk should be addressed by the supplier, and strategies should be put in place for risk management improvements. Many companies use onboarding checklists to implement risk mitigation controls based on the findings of the risk assessment during the transitional handover process.
To ensure successful contract management during the Manage and Monitor stages of the supplier lifecycle, it is important to have well-established processes in place that facilitate a smooth transition of the supplier into your company or an extension of an existing relationship. This includes meeting all key contractual requirements and creating detailed service inventories that clearly outline the responsibilities of suppliers and/or subcontractors for managing risks and fulfilling performance obligations as stated in the contract.
In the event of transitioning goods or services from one supplier to another, it is important to collaborate with both parties to establish a positive pathway that ensures a seamless transition for both the existing supplier (or in-house provider, if applicable) and the new supplier.
- Establish a framework for governing and supervising the transition process
- Ensure that essential staff from suppliers are identified and equipped with the necessary skills to carry out all aspects of the service, with a particular focus on critical components
- Reach an agreement on a monitoring and evaluation plan that encompasses both the transition period and the period after, ensuring that it aligns with the principles of the agreement and the expected outcomes.
To learn more about Third-party risk management and how People Tech teams can help, get in touch, and book a demo with us. Cyber Security – People Tech Group
