Skip to main content

Third-Party Risk Management (TPRM) and the Need to Go Deeper with Supplier Due-Diligence

| CENTRIS | Blog

For years, the concept of Third-Party Risk Management (TPM) was only taken lightly, enforced begrudgingly by companies who were faced with strict regulatory compliance requirements. And when the industry had to comply, it was often only with their first level of suppliers. Well, that’s all changing - and rapidly - as growing cybersecurity risks, coupled with today’s ever-complex global business markets, are putting more pressure on organizational supply chain risks now more than ever before.

Specifically, it’s time to start looking at third, fourth - even deeper-level suppliers in terms of TPRM. And digging deeper you’ll find some challenges indeed when it comes to information security. For example, a recent study found that 98 percent of organizations have vendor relationships with at least one third-party that has experienced a breach in the last two years. The study, which analyzed data from over 235,000 (primary) organizations across the globe and more than 73,000 vendors and products used by them directly (third-parties) or used by their vendors (fourth-parties), is yet just more evidence of the growing challenges of implementing and maintaining a truly effective TPRM.

Also, “This does not mean that those organizations were involved or impacted by those breaches. It doesn’t even mean that the nature of the relationship between the victim and its third parties is such that the breach could propagate to them,” the report noted. “But, it does mean that nearly every organization is at least indirectly exposed to risk from circumstances outside their control.”1

“Design & Deploy” – An Industry Leading Third-Party Risk Management Process

With any services we offer, TPRM being no different, Centris employs a proven process known as “Design & Deploy” for ensuring complete coverage of all measures relating to the broader subject of Third-Party Risk Management. Core concepts included within Centris’ Design & Deploy methodology for TPRM management include the following phases:

  1. Framework Considerations
  2. Scoping Considerations
  3. Identification & Classification
  4. Risk Assignment
  5. Due-Diligence & On-Boarding
  6. Continuous Monitoring
  7. Follow-Up/Reporting and Corrective-Action
  8. Off-Boarding
  9. Training

1 https://healthitsecurity.com/news/rise-in-third-party-data-breaches-requires-updated-risk-management-approach

About CENTRIS
As an internationally recognized business consulting firm, our highly trained employees work in every conceivable industry/sector in the global business arena. Centris has the knowledge and expertise you need for solving the challenges you’re facing. Our professionals are at the forefront of many of today’s most pressing risk, privacy, cybersecurity and compliance issues affecting organizations. We have a deep bench of talented professionals ready to go to work for you.
Ready to talk?