Blog

Best Practices for Third Party Management PoCs

During a recent Aravo webinar on “Best Practices for Third Party Management RFPs,” I stated that a proof-of-concept (PoC) and/or hands-on pilot is much more effective than the traditional RFP process when it comes to selecting a TPRM solution that will meet your expectations. I wasn’t trying to be contrarian. After 20+ years in enterprise software and participation in countless RFPs, I’ve seen too many clients come back to me two or three years after selecting another vendor through an RFP looking for help in cleaning up a failed implementation – especially in the TPRM space .

Read More

Topics: poc, proof of concept, rfp, request for proposal, best practices

Is Best Practice for RFPs not to Issue RFPs?

The RFP has long been accepted as an “objective” way to conduct vendor selection for purchases ranging from hard goods to complex services. Its often lengthy list of feature/function-oriented questions is considered a means to level the playing field between vendors while demonstrating adequate due diligence. But is it necessarily the best way to buy third party risk management (TPRM) technology?

Read More

Topics: rfp, request for proposal, rfi, request for information, best practices, poc, proof of concept, Third Party Management

Aravo Solutions Selected to Power Fidelity International’s (FIL) Global Third-Party Risk and Performance Program

Today we are pleased to announce that Aravo Solutions has been selected to power Fidelity International’s (FIL) global third-party risk and performance program.



You can read the full announcement here.




Find out more about Aravo for Third Party Risk Management (TPRM) in Financial Services. This cloud-based application is designed to help financial services firms accelerate their third-party risk programs with confidence, and support compliance with increased regulatory expectations.

Read More

Topics: third party performance management program, third party risk management, Financial Services, press release

Getting the Risk Data Right – TPRM’s Biggest Challenge

In third party risk, issues around data – data security and data privacy - often hold center court. In the wake of the recent onslaught of cyber attacks and data breaches, as well as the enhanced and new regulatory efforts to contain them, third party risk managers can often find themselves spending a lot of time talking about data.

But are they focusing on one aspect of the businesses’ data, at the expense of improving their own? Today, third party risk management (TPRM) executives are being asked to help shape their corporate data strategies, while their approach to their own risk data can be painfully out-of-date.

Two recent surveys show that while vendor risk issues may be a high priority for organizations’ finance teams, the way data is used within the risk management discipline falls considerably behind how other parts of the business may be using data to help deliver on the firm’s strategic goals.

Read More

Topics: third party risk management, third party governance, tprm, supplier risk, vendor risk, cyber risk, cybersecurity regulation, cyber resiliance, cybersecurity, data quality checks, vendor database, compliance data, risk-scoring, internal audit, regulation, Data Security & Privacy, data risk

Cyber-Criminals Target New Companies, New Supply Chains

Cyber-criminals are seeking out new prey. Industries that previously had a lower threat profile – such as oil-and-gas, manufacturing, and shipping – are now falling victim to cyber-attacks at an increasing rate. In some cases, the cyber criminals are using the supply chains of companies in these industries as entry points for the attacks. In other cases, the criminals target these companies directly. In either case, the organizations these companies are third parties to – their clients – are often impacted.   

As a result of this new trend, governments are stepping up with new efforts – laws, regulations, and guidance – to help create national supplier ecosystems that are more resilient to cyberattack. Industries are also creating their own working groups and other types of infrastructure to help increase communication about cyber risk – to share experiences as well as information on prevention and resilience. The evolution of cybercrime is rapid – governments, industries and individual companies are working hard to stay ahead of the threat.

Read More

Topics: third party risk management, third party governance, tprm, supplier risk, vendor risk, cyber risk, salary, cybersecurity regulation, cyber resiliance, cybersecurity

Third Party Risk Management - Salaries, Budget and Team Size

In this week’s blog on the results of the Global 2018 ‘Taking the Pulse of Third Party Risk Management’ Survey, we will delve into the some of the resourcing benchmarks for third party risk management.

To mix things up a little, we will also share the results of polls conducted at the CeFPro Vendor & Third Party Risk conferences in New York and London last month, where we first launched the results of the survey. This gives us some additional interesting cross-Atlantic perspectives.

 We’ll start with salary.

Salary
Why salary? Well everyone’s at least a bit interested in what the benchmarks for their profession may be, and there’s a paucity of data on third party risk management compensation. 
Read More

Topics: third party risk management, benchmarking, third party governance, tprm, supplier risk, vendor risk, survey, OCC, cyber risk, salary, compensation, budget

Third Party Risk Management Benchmarking Survey Results

Earlier this week we published the results of a survey that we conducted with the Center for Financial Professionals. With over 200 respondents from around the globe, the survey was designed to take a snapshot of the state of third party risk management, and to help firms develop their road-map to maturity, and support with planning, resourcing and direction.

The survey provided a great deal of insight, and we’ll be taking a deep dive into some of the results together with the implications for TPRM programs over the coming weeks.

We will also share the results of some polls that we conducted at the CEFPRO Vendor & Third Party Risk Conferences in New York and London where we launched the results. These provide an interesting cross-Atlantic comparison between peers.

But first to the survey results – which revealed gaps between regulatory expectation and the reality associated with third party risk programs. What looks good in theory, is often a lot harder in practice.

Read More

Topics: third party risk management, benchmarking, governance, third party governance, tprm, Financial Services, supplier risk, vendor risk, concentration risk, fourth party risk, survey, OCC, cyber risk

Expert Interview: Keith Koo on A Horizon View of Third Party Risk, Cyber-Risk, and Emerging Technologies

 

Sometimes, in the world of third party risk, we spend a lot of time looking at what is directly in front of us (or re-actively, what’s behind us), or even with our heads in the sand. Industry expert, Keith Koo, spends a lot of time looking to the horizon.

When you meet Keith – you are immediately struck by the energy and enthusiasm he brings to the topics near and dear to his heart: disruptive technology, digital innovation and cyber-security, and the intersection of all these trends with third party risk.

Not only has Keith had significant experience in managing large third party risk programs for large banks and enterprise technology companies, he now advises companies with the most complex and pressing third party management challenges as a Managing Partner at Guardian Insight Group.

However, it’s been his experience working in the Silicon Valley, that also spurred Keith’s long-term interest in digital innovation, cyber-security and emerging, disruptive technologies such as cryptocurrencies and blockchain.

Read More

Topics: Data Security & Privacy, third party risk management, blockchain, cryptocurrency, cyber risk, data privacy, technology

Aravo Solutions Wins GRC 20/20 Innovation Award for its Third Party GDPR Compliance Application

The team here at Aravo are particularly honored and excited to receive the 2017 GRC Innovation Award for Third Party Management from independent GRC analyst firm GRC20/20 for our Third Party GDPR Compliance Application, Aravo for GDPR.

This is the second year running that Aravo Solutions has been recognized by GRC 20/20. In 2016 Aravo won the GRC 20/20 Award for Value in Third Party Management, where Aravo’s Enterprise Third Party Risk Management solution was found to drive measurable value, delivering better GRC efficiency, effectiveness and agility to complex third party programs.

Read More

Topics: GDPR, Aravo for GDPR, GDPR award, GRC20/20, grc 2020, innovation award, gdpr compliance, gdpr application, aravo solutions gdpr, General Data Protection Regulation, grc award, third party gdpr, gdpr report, gdpr compliance application, gdpr solution, Data Security & Privacy

Bribery & Corruption – A growing focus for governments and companies

Although the way firms and individuals are being prosecuted for bribery and corruption continues to evolve, the overall direction of travel is towards increased responsibility for the prevention of these activities. Most FCPA actions (83%) of 2017 involved bribery schemes that relied on third-party intermediaries such as agents, consultants, or contractors.  And yet according to a recent survey, organizations are not responding fast enough by implementing the right policies and risk assessments.  

Read More

Topics: third party risk management, tprm, supplier risk, vendor risk, risk and compliance, compliance risk, Anti-Bribery and Anti-Corruption, uk bribery, Bribery, Corruption, regulation