Fundamental Third-Party Risk Management Best Practices

Podcast Transcript

Welcome to this week’s Third Party Thursday! My name is Branan Cooper and I’m the Chief Risk Officer here at Venminder.

Stay Educated

Let’s talk about some best practices. First, stay educated – read a lot and study interpretations – such as the legal analysis or industry publications or even less common places like Twitter or LinkedIn often turn up interesting nuggets of information.

Stay ahead of the curve as best you can and invite others to be involved – meet regularly with subject matter experts, and ask for input from audit and counsel. 

One conference that I attended last year in Washington, DC  was a day long financial services forum with the regulators  specifically on third party risk management. It was good to have a chance to hear directly from them on what they expect, where their concerns lie and we even had the opportunity to submit anonymously questions in advance.

While they certainly provide a long disclaimer on how what they are discussing is a matter of stated opinion and should not be interpreted as new guidance, it does give outstanding insight into what may be areas that you need to further consider in your own institution. I have seen more and more conferences solely focused on third party risk popping up out there.

Tailor Your Ongoing Monitoring Based On Service Type Or Risk Level

Tailor your ongoing monitoring to the type of service provided and the level of risk – call centers and statement production facilities require far different types of oversight.

Watch social media carefully – what are your customers saying – what may be causing potential concerns – direct them out of social media and address them in a more confidential manner but also look and see if it is a leading indicator of bigger problems.

We also set up sophisticated monitoring of our third parties – with queries looking for the name of the third party in conjunction with various terms like “enforcement action”, breach, complaint, that might indicate a concern so we could promptly investigate.

It is a real challenge to stay abreast of it but you will not believe how many times we’ve headed off major problems by reacting to an early warning sign. Also, since the CFPB has made it their mandate since day one to have a complaints protocol, you really need to look and be prepared to address items proactively. It usually takes dedicated effort and an automated solution.

I’d also suggest simple steps like checking out new third parties reputation by looking at their Better Business Bureau rating or go to RipOff Report.com and absolutely do a regular Google news search on them.

Consider a Second Review With an Independent Expert

Some other best practices...particularly when it comes to some of the more complicated analysis of business continuity and cybersecurity reviews – it’s expensive to hire that sort of talent, you will often find it’s better to hire as needed an outside consultant rather than add a new employee to your staff, particularly if you don’t need them on a regular basis or if your overall organization devoted to information technology or information security is limited on resources.

Consider a second set of eyes approach (or a four eyes approach as I’ve heard it referred to in Europe) – that basically means getting a second review of an item. While that may seem like a duplication of efforts, there is a great deal of value in getting an independent objective outside opinion on complicated matters just to make sure you haven’t missed anything. Again, make sure the effort is documented and you note the qualifications of the independent party to conduct such a review.

Automated solutions cut down on work and re-work and reduce the propensity for errors. I’ve known many companies that do all of their vendor management on excel spreadsheets, but that just doesn’t feel sustainable, particularly when guidance changes and you’d in theory need to go in and re-do hundreds of spreadsheets. 

Don’t Cut Corners

Don’t cut corners – sounds easy but believe me, it is tempting, when workloads are high or time constraints exist, particularly if you’re a one person team trying to do third-party risk management as just one component of a larger compliance program. Unfortunately, that’s when mistakes get made or facts get overlooked. 

The time and effort you put into a third-party risk program pays off in many ways – cutting corners can cause it to all fall apart and thus expose your bank and its customers to undue risk. This was always one of the things that kept me up at night, quite frankly, making sure we weren’t just rushing through things for the sake of time or efficiency – I’d like to think that I generally had the consumer’s best interests in mind while also protecting the financial institution. 

There are certainly times where you get pressured on deadlines or have to make exceptions – the only advice I have there is what I always firmly believe is the role of the second line of defense. Analyze the situation, limit the occurrences, document the possible consequences and escalate and communicate the concerns. Ultimately, sometimes you can’t control a situation but you can advise them how bad it might hurt if the worst case scenario plays out. 

Again, I’m Branan and thank you for watching! Don’t forget to subscribe to the Third Party Thursday series.