Blog

Bribery & Corruption – A growing focus for governments and companies

Although the way firms and individuals are being prosecuted for bribery and corruption continues to evolve, the overall direction of travel is towards increased responsibility for the prevention of these activities. Most FCPA actions (83%) of 2017 involved bribery schemes that relied on third-party intermediaries such as agents, consultants, or contractors.  And yet according to a recent survey, organizations are not responding fast enough by implementing the right policies and risk assessments.  

Read More

Topics: risk and compliance, Anti-Bribery and Anti-Corruption, third party risk management, Corruption, Bribery, compliance risk, tprm, uk bribery, supplier risk, vendor risk, regulation

Five Third Party Risks The Regulators are Focusing On

It’s the billion-dollar question – what is on a regulator’s mind when they walk through the door of a firm? What kinds of things are they looking for – and is the firm prepared?

The focus on third party risk management by regulators has increased significantly over the past few years.  The regulators themselves are providing some clear and coherent guidance on their expectations, such as: OCC Bulletin 2013-29, “Third-Party Relationships: Risk Management Guidance; FFIEC Appendix J: Strengthening the Resilience of Outsourced Technology Services. And, if you’re looking for a ‘crib-sheet’ of what the examiners are likely to be looking at, there’s also OCC Bulletin 2017-7: The OCC's Supplemental Examinations Procedures for Third Party Relationships.

In February 2018, Aravo brought together a panel of experts, two of whom were former US regulators, to talk about how supervisors are thinking about third party risk management. You can listen to the broadcast here – but we’ve also distilled it down into five key take-aways.

Read More

Topics: risk and compliance, third party risk management, information security, compliance risk, tprm, third party risk, cyber risk, supplier risk, vendor risk, occ compliance, third party risk regulators, regulatory frameworks, third party compliance, third party vendor, FFIEC, concentration risk, fourth party risk, geopolitical risk

Expert Interview: Tom Garrubba on Six Ways Collaboration Can Enhance Your TPRM Program

Collaboration is a term that makes people either cheer or wince. However, today collaboration is essential to be a successful third party risk manager – the discipline has moved well beyond administrative box-ticking. Now, a strong culture of collaboration can help create the right environment to foster TPRM program excellence, and drive real value for organizations.

Read More

Topics: risk and compliance, third party risk management, GDPR, board of directors, governance, tprm, third party risk, risk appetite, board accountability, third party governance, benchmarking, supplier risk, third party supplier, vendor risk, occ compliance, risk assessment, shared assessments, third party risk assessment, standardization programs, gdpr processor, third party risk regulators, regulatory frameworks, internal audit, third party compliance, third party vendor, FFIEC

Third Party Risk - A Unique Kind of Operational Risk

Third party risk management is on a journey. A journey that is being accelerated and guided by increased regulatory attention.

Read More

Topics: risk and compliance, third party relationships, Financial Services, reputational risk, regulatory risk, risk-scoring, third party risk, performance scoring, regulatory compliance, operational risk, supplier risk, third party supplier, Risk Management Framework, vendor risk, performance management program, enterprise risk, occ compliance

Third party scorecards: Making an improved culture of collaboration a reality

Scorecards that measure the performance of suppliers and vendors that a company contracts with have been a business tool embraced by procurement for some time now.

However, there’s an evolution underway. Increasingly businesses are recognizing that a holistic third party scorecard that also embeds risk and compliance metrics, can not only help drive continuous improvements in vendor performance, but can also help reduce the risk that third party engagements may bring to the enterprise. What’s more, scorecards can also be leveraged as a collaborative tool to help raise the collective bar of the third party ecosystem – especially in areas such as IT security.  Operational risk, Information Security and Compliance are all now stepping up to the scorecard plate.

Read More

Topics: risk and compliance, third party relationships, Data Security & Privacy, information security, reputational risk, regulatory risk, risk-scoring, third party risk, data privacy, performance scoring, organization risk, regulatory compliance

Whetting the Appetite in Third Party Risk

A snapshot of the results of two new audience surveys suggests that the concept of “risk appetite” within the third-party risk management framework is still finding its feet. Attendees at a pair of June New York and London conferences, aimed at the financial services industry’s third party risk professionals, responded very similarly to three key questions.

Read More

Topics: risk and compliance, Financial Services, third party risk management, compliance programs, risk management, governance, reputational risk, compliance risk, tprm, event, third party risk, EMEA, survey, risk appetite

Evaluating Third Party Risk and Performance

Best practice approaches to risk and performance scoring and automated workflow

As businesses have evolved and matured, so too has their approach to third parties. In the past, companies focused more on transactional ‘supplier’ relationships, typically for raw materials or ‘parts’. However, today third party relationships form a much deeper and far-reaching part of the strategic and operational ecosystem of any Global 2000 organization.

DOWNLOAD THE WHITE PAPER

Read More

Topics: risk and compliance, third party risk management, Global 2000, compliance risk, tprm, business complexity, scale, business change, business scale, white paper, third parties, risk-scoring, performance scoring, automated workflows, risk dashboard

Board Reporting, Risk Scorecards, Cybersecurity and more – takeaways from CEFPROs Vendor and Third Party Risk USA Conference

Earlier this month, I attended and chaired at the Center for Financial Professional’s conference on Vendor and Third Party Risk USA in New York. The two-day event highlighted the complexity that third party risk managers face, with topics as far ranging as cyber-risk at fourth parties, to applying third party risk frameworks to intra-company organizations. The event also demonstrated that the discipline is having to evolve and mature fast in order to keep pace with the changing digital landscape as well as ongoing regulatory change. Here are my top takeaways from the event, which I hope you will find of interest.

Read More

Topics: Anti-bribery & Anti-corruption, risk and compliance, Financial Services, third party risk management, Responsible Sourcing, compliance programs, business case, High Technology, risk management, governance, reputational risk, compliance risk, tprm, event, third party risk, EMEA

CEFPRO's Vendor & Third Party Risk EMEA conference - Top 10 Key Takeaways for Third Party Risk

This week, I had the pleasure of chairing Day one of the Center for Financial Professional’s conference on Vendor and Third Party Risk EMEA. The conference brought together insights about the evolution of the discipline as well as some key best practices. Here are my top ten takeaways from the event that I would like to share.

Read More

Topics: Anti-bribery & Anti-corruption, risk and compliance, Financial Services, third party risk management, Responsible Sourcing, compliance programs, business case, High Technology, risk management, governance, reputational risk, compliance risk, tprm, event, third party risk, EMEA

Empowered Third Party Due Diligence: Aravo and Dow Jones Risk & Compliance

With continued bribery and corruption enforcement actions high on the agenda of the regulators, companies should be looking to raise the bar on the due diligence of their third parties, both at onboarding and as part of a continuous monitoring process.

Read More

Topics: risk and compliance, Anti-Bribery and Anti-Corruption, third party risk management, ABAC, governance, regulatory risk, Dow Jones, due diligence, audit, workflows, reporting, risk-scoring