Enterprise risk management teams are struggling to effectively mitigate third-party risk in an increasingly interconnected business environment, according to a Gartner survey of 100 executive risk committee members in September 2022. 84 percent of respondents said that third-party risk ‘misses’ resulted in operational disruptions. Gartner defines a ‘third-party risk miss’ as a third-party risk incident resulting in at least one of the outcomes shown in figure one, below, once or more in the 12 months leading up to the survey.
Figure one: Evidence of third-party risk misses.
“ERM involvement in third-party risk management activities has increased across the board since 2016,” said Chris Matlock, vice president, research in the Gartner Legal Risk & Compliance Practice. “However, just doing more isn’t enough because the characteristics of third-party risk undermine the effectiveness of a typical ERM setup.”
ERM is struggling to elevate the right issues because it is generally failing to limit its focus to a manageable set of issues. ERM leaders are not clearly defining which issues must be acted on first, and they are not typically preparing their audiences well to take tangible steps on the issues they surface.
Enterprise third-party risk management
There are three aspects that ERM must do differently to improve effectiveness in managing third-party risk in a large organization, an approach Gartner calls enterprise third-party risk management. Essentially, this is an approach to help ERM teams manage the information overload that is being created by the exponential increase in risk volume and variability brought about by the rapid growth of third parties use.
- Third-party risks tend to be high volume, heterogeneous in nature, and vary greatly in importance across the business. It is hard, therefore, to identify and prioritize what matters most. ERM must first isolate and combine only those inputs that matter most at the enterprise level, enabling them to focus on aggregating the most important inputs and addressing the most critical enterprise third-party risks.
- ERM must work to enable alignment across a diverse set of risk owners to obtain a holistic view and create opportunities for them to work towards consensus. In practice, this means facilitating direct thought-partnership between risk co-owners with ERM adding expertise and aligning actions, as opposed to ERM acting as a central co-ordinator of all risk information and mitigation.
- ERM’s role as a trend spotter is also undermined by the expanding third-party landscape because the potential issues are too numerous and available data is often point-in-time and lagged. Again, the solution is to narrow down the scope of what is being monitored, limiting focus to the most critical emerging issues and proactively tracking them with a set of easily monitored forward-looking indicators that enables ERM to reliably spot critical enterprise risk trends.
“With third-party risk exposure elevated and a multitude of incoming threats on the horizon, risk committees are expecting ERM to play a greater role in managing third-party risk,” said Matlock. “Yet traditional ERM posture is struggling to provide a concise, actionable view of third-party risk at the enterprise level. That’s why ERM must focus on enterprise third-party risk management, which involves defining enterprise-level priorities, enabling cross-functional alignment, and monitoring forward-looking indicators.”
