RegTech Interventions in Vendor Risk Management

Vendor Risk Management (VRM) or Third-Party Risk Management (TPRM) is emerging as a key focus area for the Enterprise Risk Management team in the recent years.

Mitigation of Third-party Risk is becoming increasingly challenging given the interconnected Business environment. Also, many financial institutions are becoming increasingly reliant on third parties to ensure smooth business operations, scale up internal teams, increase efficiencies and introduce innovations. However, it is also exponentially increasing their exposures to the risks that emanate from Third parties.

While regulatory guidelines are in place to manage third party risks to protect the interest of customers, employees, and other stakeholders, it has become imperative for financial organizations to establish a robust and a well-defined TPRM framework to manage the TPRM lifecycle encompassing onboarding, due diligence, monitoring and reporting.

With organizations heavily relying on third party suppliers for delivering their critical business services, failures by such third-party vendors can significantly impact their quality of delivery, customer trust and reputation. Below are some of the key challenges faced by organizations in identifying and managing their suppliers and implementing an effective risk mitigation strategy for vendor risk management.

1. Vendor Concentration Risk— Few years ago, organizations used to work with multiple vendors as a risk diversification strategy. However, with digital transformation and the move towards vendor consolidation for cost optimization, they are constrained to select one or two suppliers as their ‘preferred vendor’ partners. As the relationship with these preferred vendor partners matures, and organizations become more comfortable and dependent on them for all their strategic transformation initiatives, it exposes them to the risk of vendor concentration. Any regulatory or financial impact to their vendors tends to impart a direct impact on the organization’s reputation and market share.

2. Third-party Governance — Lack of governance is susceptible to heavy regulatory penalties for banks and financial institutions which are constantly in the radar of central banks and other supervisory authorities. Hence it becomes imperative for organizations to focus on increased governance with respect to third party management.Regular review of supplier contracts and other processes in third party risk management like reporting, remediation and issue management are time-consuming and involve heavy documentation that most often seem to be ambiguous and insufficient.

3. Supplier Risk Assessment — Conducting a risk assessment of an organization’s suppliers is important to ascertain the level of exposure to the third-party vendor and to look for any red flag issues. The challenges posed here may range from establishing a robust method of assessment to determining the appropriate risk scoring methodology to derive the risk profile of the vendor. The initial risk classification will decide the level of ongoing diligence and monitoring that will be required.

4. Regulatory Scrutiny on Data Protection — Excessivedependence on third parties is also creating challenges when it comes to regulatory scrutiny in terms of cyber security risks - data leaks, privacy breaches, loss of customer data, information security compromise, etc. Non-compliance by third parties can be highly detrimental to the interests of the organization and affect their reputation and operational resilience.

RegTech Adoption in Vendor Risk Management Lifecycle

To iron out these challenges and to enable a smooth business partnership with the vendors, organizations are endeavoring to digitalize the processes and functions in Vendor management life cycle. In terms of RegTech Adoption in this space, many vendors governance RegTech solutions enable to automate and streamline vendor due diligence, relationship management and compliance monitoring and other such critical processes.

Listed below are some of the Key areas where banking organizations are leveraging RegTech solutions.

1. Vendor Due Diligence and Assessment

Third party due diligence is the first and most important step in vendor assessment and needs to be done not only while onboarding but also during contract renewals. Organizations spend an incredible amount of time in assessing the credibility, reliability, and financial stability of the vendors through credit checks and screening processes seeking information from various external agencies. Many leading RegTech companies offer intelligent risk feeds that provide information about the risk ratings and financial profile of the third parties and can help in making an informed decision and reduce the man hours involved in these activities.

2. Contract Management

Creation and maintenance of third-party contracts and the documentation that goes with it is a complicated task, but not when a technology solution is in place. It is not only the documentation that involves a lot of privacy and confidentiality clauses from legal and regulatory perspective, but also the ongoing management of the vendor engagement that involves, third party governance, contract maintenance and continuous monitoring and feedback mechanism.

RegTech solutions can enable this by providing vendor portfolio management solutions with workflow capabilities to monitor and track the contract management from creation to closure as they move into different stages. A well-built Vendor portal serves as a centralized transparent platform for effective collaboration between all the concerned stakeholders eliminating inefficiencies in communication.

3. Reporting and Oversight

Monitoring and Reporting of Metrics, KPIs and KRIs is also an important aspect in vendor risk management. Ability to analyze the risks involved in vendor assessment, early identification of issues, and notifying of upcoming and past due activities with respect to contract renewals, periodic due diligence etc are crucial for continuous monitoring and oversight.

Automated technology solutions in this area can help in risk classification of third-party suppliers and provide visibility into the changing risk profile of the vendors. Customized Operational dashboards can provide analytical insights to senior management on the performance of the different vendors and aid in decision making during vendor consolidation. Reporting capabilities are very useful to organizations to deliver several internal and external reporting requirements including adhoc regulatory requests and audits.

4. Case Management and Remediation

Non-compliance with contractual obligations and non-conformance to policies, standards and guidelines become inevitable when dealing with a diverse vendor ecosystem. This may result in issues requiring resolution and /or remediation. Establishing strong internal controls can help in minimizing the incidence of issues.

Issue management and Case management solutions enable organizations to set threshold values and trigger events which will generate alerts as and when there is a breach and send automatic notifications to concerned stakeholders to investigate the issue and initiate corrective action. This facilitates effective Triage process which is vital for Issue remediation and resolution.

Third Party Risk Management involves many complexities and implementing a robust vendor risk management solution is the key to securely engage with third parties for delivering critical business services. As part of a comprehensive supplier life cycle review, organizations must consider risks like sub-contractor risk, cyber risk, supply chain risk and legal risk not only while executing vendor management contracts but also as a continuous monitoring process. Conducting appropriate due diligence while evaluating and employing third party contractors, and having strong internal controls, can help to avoid data breaches and resultant penalties, legal action, and reputational damage to the organization. Establishing and maintaining an effective supplier risk management framework will ensure that all risks from sourcing till issue resolution are managed efficiently and pave the way for a strong resilience strategy.

About the Authors
Ajay Katara is Consulting Partner, Risk and Compliance at Tata Consulting. He has more than 18 years’ Experience in Consulting, Implementation & Solution design space cutting across Financial and Non-Financial Risk. Driving Large Transformations across RegTech initiatives, Vendor Risk, Stress Testing, Capital Adequacy, Regulatory reporting, Credit Risk and Compliance functions. Gita Srinivasan is Consulting Partner, GRC with 20 years of experience as a functional consultant in Business Analysis & Consulting, Risk and Regulatory Compliance, Data Management, and Audit & Reporting.

The views and opinions expressed in this article belong solely to the authors and do not represent those of the authors’ employer organization.