Companies today are relying more and more on third parties to grow and thrive. According to Gartner research from 2019, over 60% of organisations were working with more than 1000 third parties. While this is all business as usual, the more this occurs, the more organisations are exposed to risk.
Third parties have greater access to organisational data assets. For some of their own work, these third parties work with other fourth and fifth parties. This makes it a lot harder for organisations to assess and mitigate the risks they are aware of—leaving aside those they’re unaware of.
Gartner also reports that in 2019, 71% of organisations reported that their third parties worked with more third parties compared to three years ago. This, in all likelihood, will grow in number over the next few years.
Traditional third-party risk management fails to identify risks
Traditional approaches used for third-party risk management focus on fixed points in time. They also rely heavily on due diligence and recertification that is done in advance. This means that these approaches don’t really focus on ongoing monitoring strategies.
According to Gartner, 73% of organisations dedicate their effort to due diligence and recertification. Only 27% allocate resources for ongoing monitoring efforts. This makes it’s clear that a fixed-point-in-time approach fails to address ongoing risks. As Gartner discovered, the only way to improve this is through an iterative approach.
This means that effective third-party risk management is based on continuous monitoring.
This approach includes data gathering before establishing a third-party relationship. It means that you need to mitigate risks throughout the engagement instead of before.
Especially this Christmas, leaders must make an effort to shift to an iterative approach for third-party risk management. This can help them identify risks throughout third-party relationships and account for changes in the business environment.
An iterative approach improves business and risk outcomes
Gartner also found out that businesses that employed an iterative approach recorded improvements in business and risk outcomes. According to the study, business partners in organisations that had continuous third-party risk management strategies were:
- 3.5 times more satisfied with the business’ ability to engage third-parties.
- Twice as satisfied with their capacity for remediation before any potential impact.
- 1.5 times more satisfied with their capability to identify third-party risks before it was too late for remediation.
Shifting to an iterative approach for third-party risk management
If you have a point-in-time third-party risk management strategy, you can transition to a continuous and adaptive system in three steps.
1st step: Focus on critical risks and streamline due diligence
Cybersecurity due diligence is ‘the review of the governance, processes, and controls that are used to secure information assets’.
One way you can streamline this process is to use a data-driven method to determine critical risks that have impacted your business in the past. This can help you gain insights on emerging risks and make your third-party risk management strategies more effective and efficient.
2nd step: Monitor changes by establishing internal triggers
Establish triggers throughout your business to better monitor your third-party network. This can signal any changes that occur in any third-party relationship. This type of cybersecurity monitoring can help you identify weaknesses or potential compromises for early mitigation.
3rd step: Create controls and incentives to monitor changes
This is the final step in ensuring a successful shift to an iterative third-party risk management approach.
Embed controls that employ ongoing monitoring such as cybersecurity ratings, which is an objective validation of your level of security. Controls like these will improve continuous monitoring and make this shift a smoother and more effective one.
Leverage powerful third-party risk management strategies to stay safe this Christmas
Integrate an iterative approach to third-party risk management instead of a traditional point-in-time approach. Contact RiskXchange to receive your cyber risk score for continuous monitoring of your third-party ecosystem!
RiskXchange is a company founded and led by recognised experts within the security industry who have held leading roles in companies like IBM Security.
