Vendor Management Risk Mitigation:

Transcription

1 Vendor Management Risk Mitigation: The Importance of Having a Formalized Methodology Sun Life Financial Laura Williams AVP, Procurement Opus Sam Mele Vice President Sales sig.org/summit

2 Case Study: Supplier Management and Risk Mitigation

3 Today s Speakers Laura Williams AVP, Procurement Sam Mele Vice President Sales

4 About Hiperos 3PM The leading SaaS platform for managing third parties Purpose-built to minimize third party risk and maximize their value Manages third parties and third party relationships Accelerates / automates / enforces third party Onboarding Risk Segmentation / Scoring Due Diligence Risk / Performance Monitoring Protects against reputational harm, regulatory exposure and revenue loss Reduces the cost of third party management 4

5 Financial Industry Challenges Low Margins from continued lower interest rates Increased cyber threat Data Breaches Ransomware Malware etc. Increased Regulatory Costs MRA, Board Resolution, Consent Orders, Fines, Censures etc. Increased competition from non traditional players Startups, Fintechs, other established players Blurred lines between Vendors, Third Parties, Clients Prudent Risk Management practices across all risk domains How do we manage risk and continue to create value?

6 SUN LIFE FINANCIAL SUN LIFE FINANCIAL IN 2016 A $32 billion (1) leading, international financial services provider operating through a balanced and diversified model focused on creating shareholder value now and in the future Click to edit Master title style (1) Market capitalization (C$), as of December 31,

7 Discussion Outline Drivers of Supplier Risk Key Challenges Supplier Risk & Performance Management Program Supplier Management Best Practices Leveraging Technology Lessons Learned 7

8 Drivers of Supplier Risk Change in use of technology Increased engagement of suppliers for non-traditional services/outsourcing Increase in threats to protection of data stored in technology or used by a supplier Increased and changing regulatory requirements Expectation of Clients / Customers Expectation of the Board and Enterprise Risk Committees 8

9 Supplier Risk Defined Risk Description The risk of financial loss, operations disruption and / or reputation harm as a result of inadequate performance or failure of suppliers. Supplier risk is a composite of various operational risk elements including privacy, legal/regulatory, business continuity, information security, data/records management, IT currency and reputation. External Drivers Suppliers face similar technology threats (e.g. cyber security) that Sun Life does Regulators (OCC, CFPB) have increased their focus and extended bulletins to all third parties Sun Life customers are extending their focus beyond Sun Life controls to our controls over our suppliers Internal Drivers Nature of supplier relationships is changing / more complex with increased technological inter-dependence Sun Life expects its suppliers to have adequate standards and controls, similar to its own to address external factors / threats Inconsistent supplier engagement and management practices / unclear supplier relationship management responsibilities

10 Challenges Organizational size and geographies Dispersed ownership of supplier risk Corporate/Operational Risk, Business, Individual SRMs, Legal, Privacy, Information Security, Enterprise Business Continuity, Strategic Sourcing Defining the Supplier Risk Landscape what is in and out of scope Understanding who has access to what both internally and externally 10

11 Sun Life Supplier Risk Management Framework The supplier risk management framework for suppliers and outsourcers includes several inter-related elements including supplier lifecycle guidelines, policies and standards, organization roles and responsibilities, tools and templates. The framework embeds practices throughout the supplier lifecycle targeted to identify and reduce risk. Establishes standards and consistency in supplier governance process throughout the supplier lifecycle; defines relationships to other control processes Consistent practices for all supplier sourcing and procurement activity Enterprise supplier and procurement standards & EOG Outsourcing Policy & EOG SLF Roles & Responsibilities SLF Supplier Risk & Performance Management Framework Sourcing methodology and tools Procurement / Buying guidelines Supplier Lifecycle Guidelines Supporting Infrastructure (People, Process, Tools) Supplier Risk Assessment Supplier Segmentation Supplier Relationship Management Report / Tools / Scorecards Consistent practices for supplier assessment, engagement and ongoing management and monitoring Common tools, processes & technology (e.g., P2P, Contract management, supplier information management, PIA)

12 SLF Supplier Risk & Performance Management Program Program conception in 2014 with an goal to develop a framework to identify and manage supplier relationships throughout their lifecycle Objectives Define and assess supplier risk in a consistent, sustainable manner Incorporate current and emerging regulatory requirements Identify and incorporate existing practices (and Policies) both those that work well and need improvement Identify roles and responsibilities throughout the organization Build a realistic implementation and transition plan Develop policy, standards and guidelines (tools, templates) Communicate and Educate 12

13 SRPM Implementation and Transition Planning Sun Life relies on suppliers to support our business process. The SRPM Standard and EOG provides a risk based approach to consistently assess and manage suppliers with supporting tools and infrastructure Understand Supply Base Risk-Based Analysis Supplier spend reviewed Ownership and SRMs confirmed Contracts filed and risk assessed Missing contract identified 2015 Supplier Tiering Supplier Management Guidance Supplier tier established Right-size management applied Contracts missing identified Risk-based gap analysis/reporting 2016 Sustained Supplier Risk & Performance Management Activities Risks identified, assessed & mitigated Owners identified Suppliers managed Grow program support Reportable, defensible Supplier information

14 Setting the Stage for Framework Execution Phase I Scope and Assess Risk Consistently Key Principles 1. Define Roles & Responsibilities 2. Find the Right Stakeholders Accountable Executive Day to Day Supplier Manager Procurement & Sourcing Services SMEs 3. Set a manageable scope & focus measurement on the right subset 4. Allow for ad hoc inclusion Review with SLF R&C, BUCO Stakeholder Workshops Focus on Areas of Greatest Impact Initial SLF Supplier List 18,000+ Sort by Top 80% Spend Business Assess Risk Profile 5. Prioritize & capture early wins Total Supplier Base Kick Off Review High Risk/Outsourcing Start with Suppliers that have the greatest impact on Business Tier 1 &2 Setting the scope and aligning with current SLF Canada Supplier Management practices in partnership

15 Framework Execution: Phase II Supplier Segmentation Phase III Full Supplier Risk & Performance Management Based on the results from the first phase, SLF will have a focused approach to supplier management with suppliers. Supplier Risks Value Supplier Value vs. Resource Effort SUPPLIER TIERING PROCESS Supplier Value Resource Effort Time vs. Supplier Risks ILLUSTRATIVE Segmenting the supply base will focus the resources Supplier performance management plans including scorecarding, SLA tracking, etc. Formalize SLF and Supplier operational and strategic meetings Time 15 Supplier and resource value is maximized through the application of consistent supplier management tools and processes.

16 Supplier Risk Management Best Practices Know your universe what is the starting point and focus on areas of greatest impact Define the Risk both the risk drivers and the risk impact, what is considered a high risk supplier and why Consistency in assessment and terminology is Key critical, material, not-material, key, important, significant. Find the WIIFM for the business and make it easy to do business with you from resource capacity to risk mitigation Have a plan and spell it out with clear roles and accountabilities Integrate with processes that already work don t try to fix what isn t broken as a starting point Build upon processes that work well and continuously improve 16

17 Leveraging Technology Technology will be your hero Consistency in data capture means consistency in reporting Technology as evidence both direct and indirect, directly embed in technology and the technology itself is a form of evidence Phased and integrated approach to technology it does not have to launch with full functionality all at once and can integrate with existing platforms Regulators love technology 17

18 Supplier Life Cycle and Technology

19 Lesson Learned Find your supporters early and consider a pilot Make it easy to comply Leverage existing risk committees and subject matter experts Tap into existing controls and technology processes Establish and document realistic and measureable targets Cast a wide net - talk to industry experts, colleagues and consultants Report often and don t get discouraged 19

20 Wrap-up Third party management/supplier Risk Management is about good business practices enforcing good business results. The only constant is change flexibility is key to success This is bigger than just your suppliers or vendors. (Define your universe) Automation enables you to drive consistency, execution and auditability across the entire portfolio Third party management is about transforming data into actionable intelligence Information from technology provides continuous oversight through a closed loop process Effective third party management is not an option it is a must driven straight from the Board 20

21 Thank you Laura Williams Sun Life Financial AVP, Procurement Sam Mele Vice President Sales Opus

22 Evaluation How-to: Why? Your feedback drives SIG Event content By signing and submitting your evaluation, you are automatically entered into a prize drawing How? Option 1: App 1. Select Schedule 2. Select Schedule by Day 3. Select Day 4. Select Session 5. Scroll to Description 6. Click on the Evaluation link Option 2: Browser 1. Go to 2. Select Session (#03) COMPLETE & SUBMIT EVAL

23 Session #3 Vendor Management Risk Mitigation: The Importance of Having a Formalized Methodology Laura Williams Sun Life Financial AVP, Procurement laura.williams@sunlife.com Sam Mele Vice President Sales Opus smele@hiperos.com Download the App: bit.ly/sigamelia Tweet: #SIGspring17

24