Integrating a robust third-party risk management program with the vendor onboarding process

Transcription

1 Integrating a robust third-party risk management program with the vendor onboarding process

2 Introductions Kevin Bushbaker Alexion Senior Director Global Requisition To Pay Colin Meunier Alexion Associate Director Source-to-Pay Eric Walsworth Ernst & Young LLP Senior Manager Pradeep Caplash Alexion Associate Director SAP Center of Excellence 1 Integrating a robust third-party risk management program with the vendor onboarding process

3 Agenda Introduction to Alexion and EY Third-party due diligence (TPDD) and vendor onboarding (VOB) program overview TPDD process step walk-through Practical lessons learned Q&A 2 Integrating a robust third-party risk management program with the vendor onboarding process

4 EY works with large companies across industries to address complex procurement challenges EY has more than 3,000 supply chain professionals globally EY s helps clients address endto-end procurement needs EY is a global Ariba implementation leader We serve many of the largest and best known companies Our procurement clients are often New CFO, SC VP or CPO with a transformation agenda Company or industry with a burning platform (e.g., financial or regulatory) Recent acquisitions or divestitures Dated procurement technology IDC EY ranked No.1 in Supply Chain Mgmt. Business Consulting Services IDC names EY a Leader for Worldwide Risk Advisory Consulting Services Strategic procurement: Strategic sourcing and category mgmt. Contract management Supplier relationship management Procurement optimization: Technology-enabled transformation Tax efficient procurement Operating model design and deployment Outsourcing advisory: Outsourcing health check Third party advisory deal support Procurement analytics and performance management Spend analytics Supplier performance management More than 85 clients (250+ modules) where Ariba has been successfully deployed Greater than 15 Ariba clients across each of the following sectors: Oil and gas, mining and power and utilities Life sciences, pharma, health care and insurance industries Financial services and banking Consumer products and retail Gartner Named EY a Leader in SAP implementation services. EY is a SAP Global Alliance Partner 3 Integrating a robust third-party risk management program with the vendor onboarding process

5 EY helps our clients realize procurement s strategic potential Create strategic alliances with business partners across the company Transform source-to-pay business processes Form strong commercial partnerships Drive supplier development, collaboration and integration Develop a 360-degree view of supplier relationships Integrated STP platform strategy (sourcing, PTP, CLM) Buying channel strategy Standardized process taxonomy Reduce cycle times Improve users procurement experience Procurement purpose and strategy Leverage disruptive technologies Enable efficiencies through technology Robotics Cloud Blockchain Develop procurement analytics beyond spend Use advanced prescriptive and predictive data models Deploy analytics across procurement areas to enhance decision support Develop user-focused and mobile reporting solutions Leverage big data Mine social media Invest to develop strategic category managers Identify strategic categories Establish category governance structures Develop category strategies and execution plans Define a career path and talent development program Deploy gamification and outcomesbased mechanisms Engage top talent Refresh hiring and retention strategy Develop a flexible and virtual workplace of the future Enhance knowledge management strategy Redefine procurement purpose and operating model Define overall purpose of procurement Design operating model to align with purpose Identify talent focus areas on strategic vs. nonstrategic activities Enable a holistic approach to risk management Quantify cost of risks and risk exposure Monitor and proactively address supplier risks

6 Alexion is a global biopharmaceutical company focused on therapies for patients with devastating and rare diseases 5 Integrating a robust third-party risk management program with the vendor onboarding process

7 Most organizations fall short of effectively managing the increasing risks associated with suppliers 9% is the average decrease in stock price associated with companies that announced a supply chain disruption* The road to maturing supply risk management Traditional third-party risk management is approached with a compliance mindset in a fragmented fashion. Managing third-party risk in this fashion can lead to: Damage to brand and reputation Operational disruptions Costly procurement decisions Inefficient deployment of resources * Vinod R. Singhal, Business Briefing: Global Purchasing and Supply Chain Strategies, Dupree College of Management, Georgia Institute of Technology Increasing maturity Optimized: risk management starts becoming forward looking to anticipate concerns. Integrated: risk efforts are more cross-functional and with a quantitative focus. Reactive: risk efforts are focused on responding to events after they occur and are often looked at in functional silos. 6 Integrating a robust third-party risk management program with the vendor onboarding process

8 Alexion s integrated TPDD and VOB process vision Third-party risk management framework Improved outcomes 1. Ability to make better-informed decisions on both near-term risks and strategic investments around risk Quality Capability Commercial 2. Defined risk segmentation criteria with supporting due diligence, monitoring and evaluation/response processes 3. Scalable workflow that can adapt to evolving business requirements 7 Integrating a robust third-party risk management program with the vendor onboarding process

9 Alexion s integrated TPDD and VOB process vision Third party risk management framework Enabled to expand beyond commercial risk 1. Visibility Provide visibility prior to onboarding with controls to mitigate risk/ reject them Quality Capability Commercial 2. Data gathering Use workflow to gather additional data to manage third-party risk 3. Operating model options Consolidate third-party risk management enabling operating model options (e.g., managed services) The initial focus is on commercial risk. Process and workflow are designed to accommodate capability and quality in the future. 8 Integrating a robust third-party risk management program with the vendor onboarding process

10 TPDD and VOB process and enabling technology Request Register Screen Onboard Monitor and assess Respond Capture business s request for new TPDD and/or vendor (Service Now) Vendor registers in Ariba SIPM and completes supplier profile questionnaire (SPQ) QA SPQ and assign risk category Screen third party based on diligence requirements Alexion reviews findings and recommends approve, approve with conditions, reject or escalate Objectives If third party is a vendor and approved, onboard into SAP Update SPQ based on ongoing monitoring and scheduled risk assessments Alexion reviews findings and recommends approve, approve with conditions, reject or escalate Alexion response to risk events identified during monitor and assess Supplier Information and Performance Mgmt. (SIPM) 9 Integrating a robust third-party risk management program with the vendor onboarding process

11 EY TPDD and monitoring managed services Request Register Screen Onboard Monitor and assess Respond EY Managed Services SIPM Workflow EY EY TPDD Managed Services Risk assessments initiated by defined events 1. New TPDD request 2. Scheduled assessments 3. Red monitoring alert Third parties 10 Integrating a robust third-party risk management program with the vendor onboarding process

12 Due diligence managed services delivered from EY s Costa Rica third-party management support hub Ariba data center Sunnyvale, CA Ariba global tech support Pittsburgh, PA Malaysia global business service hub Costa Rica Americas service hub India global service hub Experienced in third-party management supporting services Time zone convenience to support US and EU customers If needed, other global hubs can be made available to address any regional issues Countries with EY presence Countries without EY presence 11 Integrating a robust third-party risk management program with the vendor onboarding process

13 Commercial due diligence overview Assessment Inputs Process Outputs 1 Commercial SPQ updated with diligence findings Alexion employee enters information about vendor or other third party. Corruption Financial R G Description Description 2 3 Third party (or Alexion designee in certain instances) completes an Alexionspecific questionnaire in Ariba. EY due diligence SPIM (SPQ) Diligence scope profile Risk area A B C Corruption x x x Commercial compliance risk review framework managed by EY Adverse media Legal Geopolitical Overall (1) Y G G R Description Description Description Description 1) Design assumes overall diligence finding is max so not to miss reds due to averaging Capability + Financial x x Adverse media x x Legal x Responses to IT security questions Geopolitical x 12 Integrating a robust third-party risk management program with the vendor onboarding process

14 Commercial due diligence overview Review Inputs Process Outputs Commercial SPQ updated with diligence findings Corruption Financial Adverse media Legal Geopolitical Overall (1) R G Y G G R Description Description Description Description Description Description 1) Design assumes overall diligence finding is max so not to miss reds due to averaging Capability Responses to IT security questions Commercial compliance risk review framework managed by EY Approved/no action Approved with conditions Examples: Increased monitoring/audit Insurance (e.g., financial hedging, secure additional source) Invest in third-party improvement Escalate Reject/exit relationship 13 Integrating a robust third-party risk management program with the vendor onboarding process

15 Technical architecture of Ariba-ECC integration at Alexion (mediated connectivity) Alexion is using Ariba SIPM as source of supplier information Suppliers Alexion SSO into SIPM via Okta Platform Upstream SIPM On Demand SAP PI (process integration) Create and update vendor Confirmation with vendor ID General data Vendor master view Company code Purchasing data Supplier basic profile Address Information Bank data Accounting data Tax info Payment information Purchasing and company code information Alternate payee Alexion s Ariba SIPM instance Middleware Alexion s SAP ERP 14 Integrating a robust third-party risk management program with the vendor onboarding process

16 Alexion s Ariba SIPM SAP ERP integration Key features: Automatic creation and updating of supplier record in SAP ECC after approval in SIPM Supplier blocking and deactivation is enabled Standard SIPM and custom SPQ fields were integrated General data, bank details, tax information, company code, accounting and purchasing data Additional logic to create alternative payee information and linkage to main supplier Key benefits: End-to-end integration of vendor registration and onboarding process Significant reduction in data entry errors due to automation Overall improvement in supplier onboarding process efficiency 15 Integrating a robust third-party risk management program with the vendor onboarding process

17 TPDD and VOB process Step descriptions 16 Integrating a robust third-party risk management program with the vendor onboarding process

18 Risk triggers and diligence categorization Request Register Screen Onboard Monitor/ assess Respond Inherent risk is determined through a set of trigger questions asked during the internal Alexion TPDD Request for Third-Party Registration. 17 Integrating a robust third-party risk management program with the vendor onboarding process

19 Diligence screening and monitoring Request Register Screen Onboard Monitor/ assess Respond EY Managed Services conducts commercial due diligence and provides workflow support for the broader TPDD and VOD process. Risk assessments initiated by defined events 1. New TPDD request 2. Scheduled assessments 3. Red monitoring alert 18 Integrating a robust third-party risk management program with the vendor onboarding process

20 Example sources used for monitoring and diligence Request Register Screen Onboard Monitor/ assess Respond Content focus Example sources Financial Media/geopolitical Compliance/legal InfoNet 350,000+ sources External Thomson Reuters Eikon EY Growing Beyond Boarders Thomson Reuters Clear AML, ABC, sanctions, watch lists Financial viability assessments, corporate relationships, supply chain analytics, BLAW litigation reports, social media, negative news alerts, dynamic geographical supplier analysis, OFAC Potential additional sources (incremental costs) Country benchmarking Dun & Bradstreet DUNS, supplier evaluation risk, rating, diversity Sustainability Cyber threat Internal (Alexion) Suppliers Ecovadis In-country local support Quality Performance SLAs Other internal systems Supplier surveys via Ariba SIPM Security Scorecard EY 19 Integrating a robust third-party risk management program with the vendor onboarding process

21 Assessment findings scoring guide Request Register Screen Onboard Monitor/ assess Respond Assessment findings are summarized using red, yellow or green based on Alexion s criteria. 20 Integrating a robust third-party risk management program with the vendor onboarding process

22 Functional area approvers guide Request Register Screen Onboard Monitor/ assess Respond Decision guides are available to facilitate and standardize the approval process. Alexion functional area delegates review the TPDD findings and have four options: 1. Approved/no action 2. Approved with conditions Examples: Increased monitoring/audit Insurance (e.g., financial hedging, secure additional source) Invest in third-party improvement 3. Approved with conditions 4. Reject/exit relationship 21 Integrating a robust third-party risk management program with the vendor onboarding process

23 Alexion s internal governance escalation methodology Request Register Screen Onboard Monitor/ assess Respond Gray boxes represent escalation path to the governance committee. 22 Integrating a robust third-party risk management program with the vendor onboarding process

24 Escalation response options Request Register Screen Onboard Monitor/ assess Respond A cross-functional governance committee will address escalated risk findings using a TPDD governance response guide. 23 Integrating a robust third-party risk management program with the vendor onboarding process

25 Escalation response options Request Register Screen Onboard Monitor/ assess Respond For each escalation step, there are several options that can be considered. 24 Integrating a robust third-party risk management program with the vendor onboarding process

26 Practical lessons learned 25 Integrating a robust third-party risk management program with the vendor onboarding process

27 Practical lessons learned Dimension Governance and oversight TPRM design strategy Design the risk segmentation framework Achieve buy-in and sponsorship Objectives 1. Achieve sponsorship, strategic direction, and funding 2. Create cross-functional participation and accountability 3. Define risk scope and segmentation approach Technology and analytics Develop risk analytics capability Leverage enabling technology 1. Identify and select the sources of information for risk management analytics 2. Identify the reporting needs for all business units and participants 3. Determine method to consistently normalize and prioritize risk findings 4. Confirm alignment between technology road map and the risk management program People and organizational design Processes Design the operating model Identify resourcing, responsibilities, and location requirements Develop procedural details to operationalize the design Anticipate need to accommodate future requirements (scope and scale) 1. Design the organization to provide scalable, value-added services in a central location for cross-enterprise 2. Identify, train, and develop resources to support the program 1. Integrate TPRM with existing processes to provide value 2. Design for auditability, adaptability, and sustainability 3. Establish a normalized approval, rejection, escalation, and response guide to standardize the process 26 Integrating a robust third-party risk management program with the vendor onboarding process

28 Importance of change management WWW Cloud applications are designed for no/limited customization Common change management challenges Greater cross-functional governance and alignment is needed before selecting a noncustomizable solution. Clients with a complex geographical footprint and/or highly autonomous business units have a higher risk of poor solution adoption. Mature systems based on time-tested leading practice processes Internal processes and/or policies that are less mature and less standardized may not support the system Existing organizational structures, roles, and/or talent do not align to the way the system is supposed to work System implementation often precedes establishing clear data and process governance Faster implementation time and testing cycles Shorter implementation timelines introduce greater risk in: Identifying and engaging all impacted stakeholder groups Tailoring generic communication and/or training materials from the solution provider to fit our clients Enabling suppliers and catalogs which can result in limited availability at go-live 27 Integrating a robust third-party risk management program with the vendor onboarding process

29 Thank you for joining us today Kevin Bushbaker Alexion Senior Director, Global Requisition To Pay Colin Meunier Alexion Associate Director, Source-to-Pay Eric Walsworth Ernst & Young LLP Senior Manager Pradeep Caplash Alexion Associate Director, SAP Center of Excellence 28 Integrating a robust third-party risk management program with the vendor onboarding process

30 EY Assurance Tax Transactions Advisory About EY EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities. EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com. Ernst & Young LLP is a client-serving member firm of Ernst & Young Global Limited operating in the US Ernst & Young LLP. All Rights Reserved ED None This material has been prepared for general informational purposes only and is not intended to be relied upon as accounting, tax or other professional advice. Please refer to your advisors for specific advice. ey.com