Identify and Manage Third Party Vendor Risks:

Transcription

1 Identify and Manage Third Party Vendor Risks: Using Automation to Increase Visibility Westfield Group Brian Roche Chief Procurement Officer Opus Samuel Mele Vice President Sales sig.org/summit

2 Identify and Manage Third Party Vendor Risks: Automation to Increase Visibility October 12 th, 2017

3 About Opus THIRD PARTY & CUSTOMER RISKS Regulatory Compliance Money Laundering Bribery & Corruption Information Security Financial Viability Insurance Compliance Business Continuity Operational Performance SaaS Workflow + Data Solutions OPUS ENABLES YOU TO Identify, mitigate and report on customer & third party risks Comply with regulations Automate & streamline processes Reduce time, labor & costs Faster, more confident decisions 3

4 4

5 The Procurement and 3PM Journey 5

6 Procurement Roadmap Prioritization of Risk Management and Continuity of Sourcing Support State of Business Needs & Priorities Business Unit Design Governance Strategic Sourcing Procurement Visioning and PAC Formation: Define Procurement Vision, Mission and Strategy Develop a Procurement Advisory Council (PAC) Spend Ownership and Target Operating Model (TOM) Development: Develop Procurement Operating Model Formal Contracting Function Development Competency Profile Development & Training: Refine and utilize Competency Profile for Performance Management & Recruiting Develop Targeted Training Curriculum Procurement Governance, Policy Development and Training: Develop a Procurement Governance Structure Establish Procurement Policies and Standard Operating Procedures Governance Education and Training Technology Rationalization Strategic Sourcing Framework & Process Development: Develop a Strategic Sourcing Framework and Process Develop Strategic Sourcing Project Stage Gates Spend Taxonomy, COI, and Strategic Sourcing Wave Plan Development Strategic Sourcing Wave Plan Execution (3 Sourcing Wave Plans) Change Management component will be embedded in each of the grouped initiatives, with different scope and activities depending on the need Contracting Purchase-to- Pay Spend Analysis and Savings Vendor Management CLM System Implementation: CLM System enhancement and/or integration Procurement Performance Management: Develop a Reporting Dashboard Vendor Performance Tracking by Contract Establish Contracting and P2P Metrics P2P / e-procurement Implementation: Refine Existing Vendor Master Program Deploy Indirect Purchasing Tool Enhance vendor Collaboration Enable Service Purchase Orders Align Purchasing Proc. to Contracting Process Spend Analytics Tool Implementation: Improve and Maintain Spend Data Quality and Analysis Vendor Relationship Management Program Establish a Center-Led Vendor Management Program Define a 3 rd Party Risk Management Program Implement Vendor Scorecard 6

7 Key Highlights Operating Model CEO CFO Group Procurement Leader Legal Finance ERM / IS Category Management Leader Procurement Operations Leader Third Party Risk Management Leader* Sr. Category Manager Information Technology P2P Coordinator Third Party Risk Manager Sr. Category Manager Ins Ops & Underwriting Procurement Operations Analyst Third Party Mgmt Analyst Category Manager Group Functions Subject Matter Experts (8) Category Manager IT Procurement Contract Specialists (2) Organized by category and focuses on strategic category management and sourcing activities Contract Specialists focus mainly on contract and RFx* maintenance activities and interface with Legal Procurement Operations manages the entire P2P process, from requisition to receipt This group drives the purchasing channel strategy, owns and administers the S2P technology, and provides related tools, spend analytics, metric development & reporting Establishes Vendor Management model, including vendor classification and assessment requirements Policy, procedure and assurance activities Change Management, communications and training Category Managers are business aligned with category expertise; Operations supports the supply chain lifecycle

8 Project Plan Establish the function Measure delivery, benefits and compliance 8

9 Third Party Management People, Process and Technology Maturing Third Party Management Vendors: 334 relationships 1500 assessments Holistic vendor management capability Operating Model Board Approved Policy Communications Bifurcate All Payees by Risk Categorization 18,374 to 454 T&E vs. ASP 1 st Half Req s, Dev & Testing Procedural Guidelines Info Sec Analysts Production (6/2017) 2 nd Half execution IRQs All High Risk vendors + 1 st Half Accelerate Schedule of Reviews Moderate and Low Risk Audit and Exam Planning 2 nd Half Metrics/KPIs; Framework for holistic vendor mgmt 9

10 Inherent Risk Assessment Logic and What Follows IRQ evaluates 5 risk types and is completed by Westfield Relationship Manager and approved by 3PM, resulting in Inherent Risk Rating (IRR) IRQ responses launch risk specific evaluations that are completed by the Vendor (External Manager) and approved by 3PM or SME (e.g. InfoSec) IRR weight 1 Information Security Risk Asks vendor to complete LSQ (Low risk) or FSQ (Moderate or High risk) Notifies IS when interview is recommended; Need for onsite visit for High IS risk is determined post-interview 45% 2 Physical Access Risk Asks certain service providers (i.e. facilities related) to verify background checks when badge is requested Confirms if vendor s on-site resources have access to data or systems 5% 3 Business Continuity Risk Asks Vendor to complete BC/DR evaluation when BC risk is Moderate or High 20% 4 Country Risk Notifies Information Security of country and work elements to be offshored 10% 5 Compliance Risk Notifies SME for specific regulatory compliance Asks vendor to complete evaluation regarding client facing activity Asks vendor to complete evaluation regarding system of record protection 20% 10

11 3PM Program Assumptions and Rules of Thumb The following assumptions apply to the Third Party Risk Management process and the use of the inherent risk questionnaire (IRQ): Certain categories of products or services that inherently have little or no risk to Westfield will be classified as Nominal risk and will not require an IRQ Any third party provider governed by a Westfield standard Master Agreement requires an IRQ unless previously classified as Nominal risk Providers of products or services not requiring a master agreement (i.e. PO only) may also be classified as Nominal risk to Westfield and will not require an IRQ The following non-traditional 3 rd Parties are under review to determine future applicability (in addition to alternative management program activities) of Procurement process, including: Agencies Financial Institutions Benefits providers Reinsurers Law firms Insurance Industry Service Organizations Community Investment related organizations 11

12 Program and Tech Implementation Lessons Learned Category What could we have done better Themes Change management internally and externally Strong enforcement on training (process and system) Connecting the dots for colleagues (why are we doing this, how does it help my business) Establish expected response times, including when to escalate/accept risk Consolidation of required information for SME evaluation Better vetting of vendor owners (internal) Planned better for vendor pushback on process What went well What do we want to try What puzzles us Efficient program design Requirements were right sized given objective and time frame Successful system launch Executive support People (Third Party Management extended team) Training curriculum Team collaboration and issue resolution Streamlined questionnaires ("Less is More") Ultimately closed all high risk observations and finding (audit and regulatory) Create Internal "champions who also focus on Continuous Improvement Alternative training styles (e.g. WebEx, CBT) Provide a communication template for Relationship Managers to explain the process to vendors We need to get better descriptions of the relationships from our Relationship Managers Integration with other supply chain tools (contract database, AP, and subscription services) Formalize cycle time SLAs for vendor responses Vendor resistance (popular response) Understanding of why we need 3PM User confusion of process Wrong answers to IRQs 12

13 Key Takeaways Third party management drives compliance and reduces risk by enforcing business practices resulting in measurable results This is bigger than just your suppliers or vendors its all of the third parties with whom you interact Third party management is the responsibility of the entire organization Automation enables you to drive scalability and consistency across the entire portfolio Real-time information from tools provides continuous oversight through a closed loop process 13

14 Thank you Brian Roche Chief Procurement Officer Westfield Insurance Sam Mele Vice President Sales Opus

15 Evaluation How-to: Why? Your feedback drives SIG Event content By signing and submitting your evaluation, you are automatically entered into a prize drawing From the App How? 1. Select Schedule 2. Select Schedule by Day 3. Select Day 4. Select Session S28 5. Scroll to Session Survey COMPLETE & SUBMIT EVAL

16 Session #28 Identify and Manage Third Party Vendor Risks: Using Automation to Increase Visibility Brian Roche Chief Procurement Officer Westfield Insurance Sam Mele Vice President Sales Opus Download the App: sig.org/app Tweet: #SIGfall17

17