Third-Party Risk Management Recommendations for 2024

Podcast Transcript

Hello, this is Kelly with Venminder. 

Although no third-party risk professional can predict the ups and downs of 2024, it’s still important to be as prepared as possible. That’s why we’re giving some best practices to help prepare your program for success in the new year.

The team at Venminder includes certified industry experts who know how to manage third-party risk effectively across organizations of all sizes and industries. 

After the mid-year release of the Interagency Guidance on Third-Party Relationships, it’s probably safe to say that third-party risk management will become a larger focus area, and not just for the financial industry. Many other industries are being significantly impacted by third-party risk. 

The following recommendations are relevant to any organization that wants to strengthen their third-party risk management efforts:

• First, it’s essential to prioritize cybersecurity. The infamous MOVEit breach is still making headlines months later after the impact. Cyber threats are continuing to grow, and third-party vendors are prime targets for data breaches, ransomware attacks, and other incidents that can impact your organization and customers. Many regulators have also started proposing and implementing data breach notification requirements that detail specified reporting timeframes for security incidents.
  
  It’s essential to stay proactive in protecting your data by collaborating with your internal cybersecurity experts on new and emerging third-party cybersecurity risks. You may also want to review your third party’s cyber insurance to verify that the policy is separate from general liability. Third-party data breaches might not be completely avoidable, but a robust cybersecurity strategy can help reduce the likelihood and impact.
  
  
• Second, re-evaluate your due diligence questionnaires or documentation standards to ensure they accurately reflect the current risk environment. Updated regulatory requirements, new cyber threats, or the increased use of new technology like artificial intelligence can change a third party’s risks overnight. Make sure to partner with internal or external subject matter experts who can provide insight into these risks and make qualified recommendations on how to update your questionnaires with relevant information. 
  
  
• Third, stay informed about third-party risk management regulations. Even if your organization isn’t regulated by the Interagency Guidance, it’s highly recommended to get familiar with it, as it’s essentially the gold standard for safely and soundly managing third-party relationships. While some regulatory guidance is specific to third-party risk, other guidance can be less apparent, like state privacy laws. Overall, it helps to look at regulations, guidance, and other standards through the lens of your third-party risk management program. It’s important to make sure that your third parties are compliant with the same regulatory requirements that govern your organization.
  
  
• And finally, make a commitment to maximize your third-party risk management resources. Economic uncertainty continues to be a concern as we head into 2024, with many organizations looking for ways to cut costs. A small third-party risk management team can still be effective with the right strategy in place. Consider how to maximize your limited time and resources by identifying any inefficiencies within your current processes, whether they’re too time-consuming or they aren’t giving you the desired results. Maximizing your resources might include using subscription-based tools to monitor risk intelligence or outsourcing certain administrative tasks like due diligence document collection. These strategies can help your team manage third-party risk more efficiently by enabling them to use their skills where it's most needed. 

These recommendations are just a starting point. As the year progresses and your risks evolve and change, it’s important to continuously evaluate your program and strive for improvement. Ask for and share best practices with others in your industry and remember that a proactive approach to third-party risk management will help identify and manage third-party risks before they become major issues. With these tips in mind, your organization will be well prepared to face some of the new challenges of 2024.

Thanks for tuning in; and we’ll catch you next time!