Vendor Risk Management Scoring PROCESSUNITY WEBINAR

Transcription

1 Vendor Risk Management Scoring PROCESSUNITY WEBINAR

2 Today s Presenters Gary Phipps Director of Risk Solutions Ed Thomas Vice President of Marketing 2 ProcessUnity, Inc. All Rights Reserved.

3 About ProcessUnity Risk & Compliance Automation Risk & Compliance SIMPLIFIED Third-Party Risk Management Policy & Procedure Management Risk Management Compliance Management HQ: Concord, Massachusetts 2003 FOUNDED 3 ProcessUnity, Inc. All Rights Reserved.

4 Agenda Getting grounded: key definitions What is assessment scoring? Why embrace a scoring methodology? Discussion re: scoring methodology types (pros and cons) Using ProcessUnity to automate vendor risk scoring 4 ProcessUnity, Inc. All Rights Reserved.

5 Key Definitions Inherent Risk Residual Risk Assessment The probability of loss arising out of circumstances or existing in an environment, in the absence of any action to control or modify the circumstances. Exposure to loss remaining after other known risks have been countered, factored in, or eliminated. The process of evaluating and approving prospective and active third parties, vendors, suppliers and/or partners. Used to measure and monitor performance for the purposes of reducing costs, mitigating risk and driving continuous improvement. 5 ProcessUnity, Inc. All Rights Reserved.

6 Vendor Risk Scoring Risk Score Grade Vendor Risk Scoring is the process of applying a measured and repeatable process to establish a shared opinion of the risk that is posed by the practices of an existing or would-be third party Trend B 0 6 ProcessUnity, Inc. All Rights Reserved.

7 Vendor Risk Scoring Benefits Ensure Repeatability Eliminate Subjectivity Validate Program Results Save Time 7 ProcessUnity, Inc. All Rights Reserved.

8 Opportunities for Scoring in the TPRM Lifecycle Determine Inherent Risk Scope Assessments What is the risk of the service being used? Based on the service type and inherent risk level, which questionnaire should be used? Rate Assessment Responses Based on a score from assessment responses and/or issues documented from evaluated responses, how do we rate this vendor? Calculate Residual Risk & Determine Review Frequency Based on inherent risk and the rating from the most recent assessment, what is the residual risk and how often should we review this vendor? 8 ProcessUnity, Inc. All Rights Reserved.

9 Inherent Risk Service Types Service Risk Criteria Inherent Risk Financial Criticality CRITICAL Data Storage Customer Marketing Confidentiality PII Transaction Volume Contract Value HIGH MEDIUM Legal Reputation LOW 9 ProcessUnity, Inc. All Rights Reserved.

10 Inherent Risk Service Types Service Risk Criteria Inherent Risk Financial Criticality CRITICAL Data Storage Customer Marketing Confidentiality PII Transaction Volume Contract Value HIGH MEDIUM Legal Reputation LOW 10 ProcessUnity, Inc. All Rights Reserved.

11 Inherent Risk Service Types Service Risk Criteria Inherent Risk Financial Criticality CRITICAL Data Storage Customer Marketing Confidentiality PII Transaction Volume Contract Value HIGH MEDIUM Legal Reputation LOW 11 ProcessUnity, Inc. All Rights Reserved.

12 Scoping Assessments Inherent Risk Service Types Risk Domains Assessment Scope CRITICAL Financial Information Security Financial HIGH MEDIUM Reputation Data Storage Geographic Customer Business Continuity Compliance Questionnaire Physical Questionnaire Virtual Mapped Risk Domains Mapped Risk Domains Marketing Conflict of Interest Questionnaire Only Mapped Risk Domains LOW Legal Cybersecurity Identity 12 ProcessUnity, Inc. All Rights Reserved.

13 Scoping Assessments Inherent Risk Service Types Risk Domains Assessment Scope CRITICAL Financial Information Security Financial HIGH MEDIUM Reputation Data Storage Geographic Customer Business Continuity Compliance Questionnaire Physical Questionnaire Virtual Mapped Risk Domains Mapped Risk Domains Marketing Conflict of Interest Questionnaire Only Mapped Risk Domains LOW Legal Cybersecurity Identity 13 ProcessUnity, Inc. All Rights Reserved.

14 Scoping Assessments Inherent Risk Service Types Risk Domains Assessment Scope CRITICAL Financial Information Security Financial HIGH MEDIUM Reputation Data Storage Geographic Customer Business Continuity Compliance Questionnaire Physical Questionnaire Virtual Mapped Risk Domains Mapped Risk Domains Marketing Conflict of Interest Questionnaire Only Mapped Risk Domains LOW Legal Cybersecurity Identity 14 ProcessUnity, Inc. All Rights Reserved.

15 Rating Assessments Numeric Scoring Issue-Based Scoring Question Scores by Risk Domain Issues Overall Identified Risk Domain Weighting Assessment (with Score Severity Rating) # of, Med, Issues Satisfactory Score > 85 Satisfactory 0 Issues <3 Issues Needs Attention Score > 75 and < 85 Needs Attention 0 Issues <6 Issues Unsatisfactory Score < 75 Unsatisfactory >0 Issues 15 ProcessUnity, Inc. All Rights Reserved.

16 Pros & Cons of Assessment Rating Approaches Numeric-Based Pro: Limits personal subjectivity, supports weighted averages, calculation oriented Con: Can create unnecessary complexity, important evidence of risk may be obscured within the larger quantitative valuation Issue-Based Pro: Reduced false positives, more readily targets important risk areas, limits attention to trivia Con: Introduces greater subjectivity, can require higher skilled resources for due diligence review, may lead to some inconsistency across vendors 16 ProcessUnity, Inc. All Rights Reserved.

17 Residual Risk Inherent Risk Last Assessment Rating Residual Risk Review Frequency Satisfactory Biennial Needs Attention Unsatisfactory Annual Annual None Prior ASAP Satisfactory Triennial Needs Attention Unsatisfactory Biennial Biennial None Prior ASAP Not Required Triennial Review 17 ProcessUnity, Inc. All Rights Reserved.

18 Residual Risk Inherent Risk Last Assessment Rating Residual Risk Review Frequency Satisfactory Biennial Needs Attention Unsatisfactory Annual Annual None Prior ASAP Satisfactory Triennial Needs Attention Unsatisfactory Biennial Biennial None Prior ASAP Not Required Triennial Review 18 ProcessUnity, Inc. All Rights Reserved.

19 Residual Risk Inherent Risk Last Assessment Rating Residual Risk Review Frequency Satisfactory Biennial Needs Attention Unsatisfactory Annual Annual None Prior ASAP Satisfactory Triennial Needs Attention Unsatisfactory Biennial Biennial None Prior ASAP Not Required Triennial Review 19 ProcessUnity, Inc. All Rights Reserved.

20 Demonstration: Scoring in Action PROCESSUNITY VENDOR CLOUD

21 Vendor Risk Scoring Benefits Ensure Repeatability Eliminate Subjectivity Validate Program Results Save Time 21 ProcessUnity, Inc. All Rights Reserved.

22 RISK & COMPLIANCE SIMPLIFIED CLOUD- BASED EASY-TO-USE INTERFACE END-USER CONFIGURABLE DEPLOYS QUICKLY FLEXIBLE PRICING SaaS-based system features automatic system updates / upgrades and includes customer support. Point-and-click interface, dashboards, alerts and online help make our tools the easiest to use. Business users can configure our tools to fit their programs and processes without calling IT. Most customer implementations are completed within 30 days. Tiered pricing plans allow customers to purchase only the features, functions and licenses they need. 22 ProcessUnity, Inc. All Rights Reserved.

23 Vendor Cloud Pricing 23 ProcessUnity, Inc. All Rights Reserved.

24 Third-Party Risk Management Pre-Assessment Assessment Ongoing Monitoring FINDINGS ASSESSMENT STATUS ISSUES DASHBOARDS Schedule Your Deep-Dive Demonstration ProcessUnity, Inc. All Rights Reserved.