An Executive Guide to Third Party Management

Transcription

1 An Executive Guide to SIG Global Summit October 14 16, 2014

2 Executive Summary Companies... should take a hard look at the agents conducting business on their behalf. Kara Brockmeyer, chief of the SEC Enforcement Division s FCPA Unit. Third-party relationships have been a significant area of concern for years. We ve unfortunately found it necessary to take serious enforcement action against some of our large institutions for problems brought on by poorly-managed third-party relationships, from debt collection companies to telemarketers. Thomas J. Curry, Comptroller of the Currency Target, Alcoa, Walmart, Apple, Pfizer five major brands with one thing in common each of these companies revenues hass recently been affected by a regulatory fine or their reputations have taken a hit. In every case, the culprit was one of the company s third parties an HVAC supplier, a contract manufacturer, or a consultant whose actions have ultimately cost the company millions of dollars. Hiperos has spoken with a number of the corporate executives at the center these breaches many of whom are no longer with the company. Their conclusions are consistent: their company did not have the ability to effectively manage their third parties. Concerns ranged from cost (it s too expensive), to competence (it s too hard) to credibility (it s just not possible to manage thousands of third parties). Projects using existing systems, such as the company s GRC platform, or procurement system had failed and in most cases they were back to pen and paper, spreadsheets and manual processes. Red flags, risks, and compliance challenges simply fell through the cracks. Corporations continue to increase their use and reliance of third parties (agents, distributors, resellers, service companies, brokers, contractors, contract manufacturers, suppliers, vendors, joint ventures, franchisees, etc.). According to recent research from leading independent HfS Research 1, spending and planned spending in both shared services and outsourcing has reached a record high. However, increased regulations and regulatory enforcement, as well as recent high profile cases involving the third parties of major brands (such as those noted above), has introduced the topic of third party risk to the boardrooms of all corporations. So while the majority of companies are increasingly aware that third parties present risk, they continue to struggle with how to address this in ways that are scalable, sustainable and affordable. In this paper, Hiperos will introduce the key drivers and concerns regarding third party management, and outline best practices that companies such as United Technologies, AstraZeneca, Microsoft, Aetna, and Charles Schwab have adopted resulting in increased shareholder value over the past five years. HfS Research 2014 State of Outsourcing Study, 2013 State of Outsourcing Study, 2011 State of Outsourcing Study 2014Hiperos 2 P a g e

3 An Introduction Over the last decade, the use of third parties has grown steadily to the point where the majority of the value companies deliver to their clients often comes from their third parties. In addition to the number of third parties, the value and strategic importance of the engagements companies develop with their third parties continues to rise. While the potential benefits in terms of time to market, scope, scale, efficiencies, and cost reduction are well recognized, the risks in terms of reputational impact, regulatory exposure and revenue loss are often less evident. Companies, dependent on third parties, need to find better ways to manage these relationships. Managing third-party relationships is complex. Successful third party management combines both risk management and mitigation with value growth, and takes a holistic view of third parties across many business processes and then customizes that information for different stakeholders. Integrating People, Processes and Technology Third-party management is comprised of the people, processes and technology, enabling corporations to have visibility into and pro-actively manage the hundreds or thousands of third parties through whom they do business and the contracts or other business agreements they have with those third parties. Third- party management is not an easy automation target. Automating a repetitive process, such as invoice approval or requisition processing depends on efficient workflow. Third-party management tasks tend to be variable, unstructured business processes, and require decisions based on understanding the risks to which each unique relationship exposes the company. Historically, companies have been unsuccessful at automating these unstructured business processes because they have not performed them at all, have performed them manually, or included only on a limited subset of their third parties. 2014Hiperos 3 P a g e

4 Key Objectives In building a comprehensive, robust program, organizations should consider the following objectives: Increase the accuracy and visibility of a company s third parties, while reducing the cost of managing that data o How do I consistently add and onboard new third parties? o How do I integrate data and information that currently resides in my back-office systems? o Can I augment my information with data from external sources, such as Thomson Reuters, LexisNexis, Dun and Bradstreet? o Can I reduce the burden of updating and maintaining accurate information on my third parties? Is it possible to have a single source of truth for my third parties? Comprehensively assess and pro-actively manage multi-level risk across all third parties and third party relationships (at the specific contract or engagement level) o Can risk be assessed and managed throughout the lifecycle of the third party, from planning and pre-procurement to termination? o Can I automatically and continuously score and rank risk on all of my third party relationships? o Can I aggregate risk in ways that are important to me? By category, product, geography, business unit, etc.? o Can I systematically set and manage controls that allow me to appropriately manage the identified risk? o Do I have visibility into my sub-contractors and n-tier suppliers? Comprehensively assess and pro-actively execute a risk-based global compliance program across all third parties and third party relationships (at the specific contract or engagement level) o Can I systemically identify which third parties pose an elevated risk for specific (regulatory) compliance concerns? Bribery, information security, quality, export controls, trade, conflict minerals, environment health and safety, etc.? o How do I ensure that third parties are enrolled into the correct compliance programs? o Can I manage attestations and store copies of my third party s certificates and documents on their record? Measure and manage value from relationships after sourcing has optimized pricing and terms o Can I monitor and measure performance in accordance with the agreed upon Service Levels and Key Performance Indicators? Ensure adoption of the third party management program by the third parties themselves, as well as internal stakeholders and lines of business 2014Hiperos 4 P a g e

5 Produce meaningful information about my third parties (versus have a lot of data about them) and simplify the ability to produce reports Best Practices Effective best practices include consistent collection and consolidation of data, availability of reports and dashboards, appropriate involvement of executive management, and a verifiable audit trail. In addition, the ability to leverage technology and automate your policies and procedures allows organizations the ability to manage the entire lifecycle of a third party including: Planning Due Diligence Risk Assessment Contract Negotiation Compliance Management Ongoing Monitoring and Assessment Performance Management Termination The graphic below represents the vision of an organization s third party management program and the business processes within that program. Information Management Onboarding - Supplier registration - Contact finder - Vendor portal - Vendor management support Risk Management - Business continuity - Risk scoring - Reputational risk - Contract management - Compliance - Information security - Code of conduct - Diversity management - COI tracking - Performance Management - Balanced Scorecard - Innovation tracking - KPIs - Vendor health assessment 2014Hiperos 5 P a g e

6 Delivering Value to Your Organization Approached correctly, third party management allows an organization to implement scalable, consistent, and objective policies and processes that address the many aspects of managing third parties. The following are some of the key benefits organizations have derived from having successfully implemented a third party management program: Third party management is not just about risk or compliance it is about effecting change within an organization to drive value and growth The only constant in third party management is change flexibility is key to success You must think beyond your suppliers or vendors organizations need to manage all of the third parties with whom they interact Managing all third parties does not mean dealing with them all in the same manner take a riskbased approach to categorize your third parties Adoption or lack of it can make or break your program. Consider carefully how to ensure maximum adoption (by your third parties and internal users) as you select technology and implement processes Automation enables you to have consistency and auditability across the entire portfolio Most organizations are data rich but information poor when it comes to their third parties. Third party management is not only about data it s about transforming data into actionable intelligence Effective third party management is no longer an option. It is a mandate from the Board. 2014Hiperos 6 P a g e

7 About Hiperos Hiperos is an Opus Global company. We were founded with a single focus to help our customers get more value from their third parties and third party relationships. Today, Hiperos customers engage with their third parties in 182 countries worldwide, and depend on the Hiperos 3PM platform to control the risks and optimize the value of their third party relationships. We are fortunate to have earned the business of some of the greatest brands in the world who leverage the Hiperos Network and the power of Hiperos 3PM to protect their organizations against reputational impact, regulatory exposure, and revenue loss. Our customers include many of the world s leading companies such as Aetna, Alcoa, AON, Arrow Electronics, Astra Zeneca, AXA, Bank of Montreal, CA Technologies, Charles Schwab, Halliburton, Huntington Bank, Kraft Foods, Mondelez, Microsoft, News Corporation, Peabody, PNC Bank, Rockwell Automation, Sun Life Financial, State Street, TD Bank, and United Technologies. We recognize the ever-increasing pressure on organizations to do more with less in an environment where the number of third parties, third party relationships, regulations, elements of risk, and costs continue to increase, with no signs of a slowdown. Our dedication to optimize the user experience and create innovative ways for our customers to take control and has led to the highest user adoption rates, and the lowest total cost of ownership. Whatever your current or future business drivers for third party management, Hiperos is there to support you every step of the way; from initial planning and due diligence, to risk management, regulatory compliance requirements, compliance management, onboarding, contract risk management, and performance management. Hiperos solutions are proven to make you and your third party relationships more effective and to ensure you drive value in days and weeks, not months and years. For further details: Phone: info@hiperos.com Hiperos 7 P a g e