Know Your Third Party (KY3P®)

A third party is any entity (except customers) with a relationship with your organization. Most commonly vendors / suppliers are considered, but others include affiliates, partners and resellers and charitable organizations.

Organizations entrust their third parties with their data and their customers’ data and depend on them for their own delivery of products and services to customers. Outsourcing of core activities is a growing trend, as is the adoption of innovative externally provided technology, and the use of the cloud. Regulators require firms to identify and manage third-party relationships to ensure they have identified, understood and managed the risks involved.

The Utility model of shared assessments reduces the amount of time and effort spent by both customers and third parties completing and analyzing repetitive and duplicative questionnaires in the following areas:

• A better questionnaire based on industry leading standards
• Quicker third party onboarding
• More accurate and efficient management reporting
• Focusing expert attention on analyzing responses and issue management, not operational activities
• Reducing cost for assessments

Engaging vendors to support your business is a natural way to get support outside of your organization’s core expertise, however relationships with third parties introduce risks which must be controlled. Third party risks are controlled differently from internal risks. You cannot tell a vendor who to hire, how to build data security or how to comply with regulatory requirements. You need to build robust policies and controls to manage third party risk. You need to identify the inherent risk of the product or service provided, understand the vendors controls by asking questions, making assessments or reviewing external information about the vendor. Effective third part risk management should not be considered a one-time onboarding activity. It also includes risk-based ongoing oversight and monitoring of significant events that impacts your vendor.

An effective vendor risk management program allows you to gain full transparency into all your vendors by consolidating vendor details as well as due diligence and oversight activities in one place. This enables you to have an efficient overview of all your risks, allowing you to manage risks rather than process. KY3P allows you to place all your vendor details within the platform, effectively configure workflows to engage and inform relevant decision makers so that TPRM staff can focus on risks instead of managing spreadsheets, emails and chasing business owners and vendors.