Third-Party Risk: What You Don’t Know Can Hurt Your Business

Thanks to globalization and advanced technologies, the world economy is increasingly interconnected and a borderless market. Businesses are no longer depending on their own resources and self-developed capabilities in order to achieve operational excellence, fuel growth and drive strategic success.

For example, a retailer headquartered in Toronto, Canada, doesn’t necessarily need to rely on local suppliers to meet its customers demand. A financial services company in London, England can now employ the services of a cyber security expert domiciled in Singapore. Today, businesses are no longer going it alone.

When entering into new lines of business or expanding into new markets, it is common for organizations to leverage third-party knowledge, skills or resources, and form partnerships, alliances, and other business relationships.  These external parties have suppliers, partnerships and alliances of their own too.

Given the interconnection between third-party relationships and the inherent risks, the ability to manage these relationships is critical to success.

Ignorance is no defense

The actions of third-party intermediaries have dire consequences on the business, not just financially but also legally, operationally and reputationally. Moreover, regulators are increasingly policing third-party relationships, and when something goes wrong, the penalties can be hefty.

Think of the U.S Foreign Corruption Practices Act, UK Bribery Act, EU General Data Protection Regulation, or Brazil’s Clean Companies Act. Even if a security breach or risk incident occurs on the other side of the world, entities or individuals found on the wrong side of the law will not escape unpunished.

Activities can be outsourced, but responsibility cant’t. It is therefore imperative that business leaders develop a deeper understanding of third-party relationships including the full spectrum of risks linking in each part of the organization.

You need to adequately examine your clients, vendors, consultants, agents and other business partners, know who they are and how they operate. A basic internet search or third-party website visit doesn’t cut it. A detailed integrity due diligence is required. You need to know your business partners’ qualifications, business history, reputation and their relationship with foreign government officials.

In addition, you also need to understand the business rationale behind including the business partner in the transaction. Failure to do so could expose your organization to reputational damage, operational risk, government inquiry, monetary penalties and even criminal liability. What you don’t know about your business partners can hurt you.

Visibility over third-party business relationships

In a number of organizations, the examination of business relationships and assessment of inherent risks is left in the hands of the procurement function. The function identifies potential savings from outsourcing, the legal team drafts the contract and it’s business as usual. There is no or little follow up on the relationships.

In some cases, external relationships are managed in silos within business units. The business unit that owns the relationship also manages the risk. These individual business units have different ways of tracking their suppliers, vendors or partners, making it difficult to compare and collate them across the entire business. In addition, sometimes there is a duplication of efforts and inconsistent application of risk assessment and management standards.

In other cases, companies adopt a centralized or hybrid approach in order to help overcome the challenges presented by the decentralization model. With the centralized approach, redundancies are reduced, and risk decisions reside with a single group in turn fostering accountability for risk assessment.

However, it is important to note that with this approach tensions can sometimes arise between business units that have a working relationship with the external parties and the centralized team accountable for risk assessments. As a result, some companies pursue a hybrid model in which risk ownership is clearly defined and decision making rights are spread across a number of business functions, such as procurement, finance, compliance and risk management.

As the business is constantly on-boarding or terminating external partnerships and expanding or reducing third-party services, it’s therefore important for business leaders to develop a strategy and road map to systematically identify third parties using an inclusive definition.

For many companies, key data about business relationships resides in multiple procurement systems and in emails, spreadsheets, and text documents. Manually building a complete inventory of current contracts from these multiple sources, and then analyzing and interpreting all the data in order to assess risks and make informed decisions can prove challenging.

New technologies such as robotic process automation and natural language processing can however help obtain visibility over third-party relationships. RPA helps integrate information from disparate sources and systems without manual intervention and embed control mechanisms into an automated process, thus increasing efficiency and streamlining third-party transaction risk management.

On the other hand, natural language processing helps to analyze documents written in plain text and signal critical risks, enabling third-party controls to be automatically reviewed for potential risks emanating from inadequate or unclear contract language.

Strong governance process

Traditionally, risk has been regarded as something to be minimized or avoided, with considerable effort spent on protecting value. However, in today’s global competitive environment, in order to progress and achieve strategic success, a business should develop an appetite for risk taking. A business cannot expect to grow and expand by avoiding risk or hesitating to expand its universe of third-parties.

However, given that today organizations are being held responsible not only for their own actions but also for the actions of customers, suppliers, vendors or partners, it’s critical for company boards to provide oversight to ensure that effective third-party risk management practices are in place.

To avoid confusion, there should be clarification on who owns third-party risk in the organization, including where third-party risk management sits within the organization. It is the board’s responsibility to ensure that management establishes a clear organizational model and process for third-party risk management.

In addition, management should provide a clear line of sight to the organization’s major external-party risks by establishing an effective reporting system and keeping the board informed of how critical risks will be mitigated.

The focus should not only be on achieving cost savings or efficiencies, but also on driving value creation and meeting set objectives of the business. Thus, there should be alignment to the broader strategy of the business.

As the world increasingly becomes digitally interconnected and the extended enterprise grows and gets more complex, third-party risk management should also become a top priority for any business.

Also important to note is that assessing and mitigating third-party risk is an ongoing process. It’s about prevention rather than reaction.

Thanks for sharing:

Leave a Reply

Your email address will not be published. Required fields are marked *

Subscribe to get notified of new posts by email

Recent Posts

Categories

Finance Analytics: It’s Not About the Size of The Data

As the need to make impactful operational and strategic decisions in real time increases, CFOs are playing a greater role in the adoption and integration of data analytics in their organizations to support data-driven decision making.

Executives and business unit leaders are increasingly relying on insights produced by Finance to better understand enterprise performance. That is, what has happened, why it has happened, what is most likely to happen in the future, and the appropriate course of action to take.

In an era where data is proliferating in volume and variety, decision makers have realized it’s no longer enough to base key enterprise performance and risk decisions on experience and intuition alone.

Rather, this must be combined with a facts-based approach. Which means CFOs must set up modernized reporting and analytics capabilities with one of the main goals being the use of data as a tool for business decision making.

Appropriately analyzed and interpreted, data always has a story, and there’s always something to discover from it. However, many finance functions are failing to deliver value from their existing data analytics capabilities.

There is a misconception that to deliver actionable insights, the function needs more data for analysis. As a result, the supply of data keeps rising, while the ability to use it to generate informed insights lags badly.

Yet it’s not about the size of the data. It’s about translating available data and making it understandable and useful.

In other words, it’s about context and understanding that numbers alone do not tell the whole story. Finance leaders should connect the dots in ways that produce valuable insights or discoveries, and determine for example:

  • What is being measured, why, and how is it measured?
  • How extensive the exploration for such discoveries was?
  • How many additional factors were also reviewed for a correlation?

Further, to use data intelligently and influence better decision making, CFOs and their teams should recognize that most enterprise data is accumulated not to serve analytics, but as the by-product of routine tasks and activities.

Consider customer online and offline purchases data. Social media posts. Logs of customer communications for billing and other transactional purposes.

Such data is not produced for the purpose of prediction yet when analyzed, this data can reveal valuable insights that can be translated into action which delivers measurable benefits.

Often the company already has the data that it needs to answer its critical business performance questions, but little of it is being aggregated, cleaned, analyzed, and linked to decision making activities in a coherent way.

Exacerbating the issue is the mere fact that the company has a mishmash of incompatible computer systems and data formats added over the years ultimately making it difficult to perform granular analysis at a product, supplier, geographic, customer, and channel level, and many other variables.

There is nothing grand about data itself. What matters most is how you are handling the flood of data your systems are collecting daily. Yes, data can always be accumulated but as a finance leader:

  • Are you taking time to dig down into the data and observing patterns?
  • Are the observed patterns significant to altering the strategic direction of the organization?
  • Are you measuring what you really want to know, what matters for the success of the business?
  • Or you are just measuring what is easy to measure rather than what is most relevant?

CFOs do not need more data. What they need right now is the ability to aggregate, clean and analyze the existing data sitting in the company’s computer systems and understand what story it is telling them.

Before they can focus on prediction, they first need to observe what is happening and why. Bear in mind correlation does not imply causation.

Yes, you might have discovered a predictive relationship between X and Y but this does not mean one causes the other, not even indirectly.

For instance, employee training hours and sales revenue. Just because there is a high correlation between the two does not mean increase in training hours is causing a corresponding increase in sales revenue. A third variable might be driving the revenue the increase.

Jumping to conclusions too soon about causality for a correlation observed in data can lead to bad decisions and far-reaching consequences, hence finance leaders should validate whether an observed trend is real rather than misleading noise before providing any causal explanation.

Certainly, big data can be a powerful tool, but it has its limits. Not all data is created equal, or evenly valuable. There are situations where big data sets play a pivotal role, and others where small, rich data sets trump big data sets.

Before they decide to collect more data, CFOs should always remember data is comparable to an unexploited resource.

Even though data is now considered an important strategic asset for the organization, raw data is like oil that has been drilled and pulled out of the ground but not yet refined to its finer version of kerosene and gasoline.

The data oil has not yet been converted into insights that can be translated into action to cut costs, boost revenues, streamline operations, and guide the company’s strategic direction.

Thanks for sharing:

Doing The Right Thing For Too Long

Markets and business models are shifting, and so should you keep up with these market changes if your business is to survive and succeed. Compared with the past, the current era of digitization represents an inflection point.

Consider individual trends such as artificial intelligence, virtual reality, Big Data, cybersecurity threats, drones, the Internet of Things, driverless cars, blockchain technologies, and more.

These new technologies have significantly changed the way we connect and interact as individuals, including how businesses deliver products and services to their customers.

Reinventing your business will determine whether you succeed or fail in the digital age. As the saying goes, disrupt or be disrupted. No company, business, or industry is safe from disruption. Today, individual businesses have the potential to compete against multinational companies and win.

These businesses are quick to anticipate market changes and flexible to get ahead of the curve. Sadly, many companies are blinded by their successes and aren’t willing to disrupt themselves. They are not experiencing their desired growth trajectory because they are stuck doing the right thing for too long.

Don’t get comfortable with the status quo and allow your business to get stuck on a strategy and mindset that no longer fit the market.

Here are a few questions to ponder, the answers to which will determine the future of your business:

  • What is at the core of your strategy?
  • Are you in touch with the customers you want to serve? When customers give you negative feedback, how often do you listen and act on it?
  • Are you operating your business on the premise that you know what is best for your customers therefore they are supposed to buy whatever product or service you offer them?
  • Are you keeping up with market shifts or you only know how to grow under one set of conditions or products and services, but not how to survive and strive under another?
  • How robust and flexible is your IT infrastructure to help you innovate, perform your company’s Jobs To Be Done, and scale your business?
  • Are you creating a strong culture that is focused on customers, including a culture that not only embraces change but seeks it out?

Given our world is changing faster, it’s imperative to continuously look for signs that things are changing and think about how those shifts would play out in the short-term, medium-term, and long-term, not forgetting the impact on the execution of your strategy and enterprise performance.

The signs can reveal individually. At times, they are part of a wider trend.

Nonetheless, how you adapt will determine whether you succeed or fail. Keep learning. Learn about innovations in your industry and beyond. Try out new business models and technologies and embrace a philosophy of constant change.

Once you understand how the market is changing and evolving, you can develop the right product or service and strategy that will help you achieve your desired outcomes.

We often talk of the ability to “connect the dots” and “take a helicopter view of the business” as key ingredients for success. But how often are business leaders and their teams doing this?

Across the organization, a culture of “them versus us” prevails. Important decisions are made at a functional level with little or no consideration of their impact at the enterprise level.

Having the ability to grasp the big picture and see how different trends intersect is essential for determining the right path or course of action to pursue.

So, how do you spot market transitions and develop a clear sense of where the market is going?

  • Be curious and hungry for new ideas. Continuously ask tons of key performance questions and pay attention to what’s around you.
  • From time to time, challenge conventional wisdom. It’s easy to stick with what you know about your business model, customers, competitors, markets, or industry but dare to pivot when conditions change.
  • Don’t be nostalgic about the past or worried about protecting what you’ve built in the present. Always be curious about the future and develop a willingness to take calculated risks.
  • Ask existing and would-be customers how they feel about your company’s products, services, and strategy. Instead of turning to sources that reinforce your existing point of view, seek multiple perspectives and cross-reference them as new facts come in.
  • Develop an ability to handle multiple random data points at once. This will help you generate critical market, customer, and business performance insights and make smarter, informed decisions. Be careful to distinguish between the signal and the noise since data can be deceiving, especially when you’re looking for “confirmation” that protects your business model.

Data might not tell you why something is happening, but it does tell you what’s going on.

  • Look for patterns and abnormalities that might suggest something is going on, including any interdependencies.
  • Anticipate all the various scenarios of what could happen.
  • Plan your course of action in response to what’s happening in real time.

As the signals of a market shift increase, the need to act becomes more imperative. Note, monitoring and identifying market shifts, and effectively taking the appropriate course of action is a matter of timing.

If you continue doing the right thing for too long and lack the boldness to disrupt both the market and your own organization, you risk being disrupted and left behind. There is no company that is too big to fail. Neither is there a startup that is too small to succeed.

Thanks for sharing:

How Feasible Are Your Strategic Objectives?

Every organization sets out its goals and objectives, to accomplish its mission and vision. The two often seem like two interchangeable phrases but there is a distinction.

A goal is a desired result you want to achieve and is typically broad and vague. An objective, on the other hand, defines the specific, measurable actions each employee must take to achieve the overall goal.

It is every leader’s job to create a coherent set of feasible objectives or what Richard Rumelt calls proximate objectives. Objectives that define targets the organization is fairly expected to achieve, even overwhelm.

This is essential for ensuring energy and resources are focused on one, or a very few, critical objectives whose accomplishment will lead to a cascade of positive outcomes.

An effective strategy defines a critical challenge or opportunity and clearly articulates how the organization is going to play to win or perform customers’ Jobs to Be Done.

Thus, the objectives an effective strategy sets should stand a good chance of being accomplished, given existing resources and competence.

On the contrary, a bad strategy results in the setting of bad strategic objectives.

Long lists of “things to be done,” are often labeled wrongly as strategies or objectives. Or the desired outcome is simply rehashed with no explanation of how this will be accomplished.

It doesn’t matter how well-thought your strategy is in response to an identified challenge or opportunity. If the resultant strategic objectives are merely a list of things to do, or just as difficult to achieve as the identified key challenge, there has been little value added by the strategy.

In today’s highly competitive, uncertain, dynamic, and complex environment in which a leader’s ability to look further ahead is diminished, it is better to focus on a few pivotal items through taking strong positions, creating options, and building advantage.

First identify the key challenges or opportunities for the business. Look very closely at the changes happening within your business, where you might get an added advantage over competition.

Next, create a list of the issues, including the actions your company should take.

Then, trim the original list to a noticeably short list of pivotal issues and proximate objectives by identifying one or two feasible objective(s), when achieved, would make the biggest difference. Remember, the identified objectives should be more like tasks and less like goals.

Now, focus on the objectives by channeling skills and available resources to accomplish the overall goal.

Once accomplished, new opportunities will open up resulting in the creation of more ambitious objectives. This cycle will help you develop a system that enables the setting of feasible strategic objectives.

Thanks for sharing: