Blog

Five Third Party Risks The Regulators are Focusing On

It’s the billion-dollar question – what is on a regulator’s mind when they walk through the door of a firm? What kinds of things are they looking for – and is the firm prepared?

The focus on third party risk management by regulators has increased significantly over the past few years.  The regulators themselves are providing some clear and coherent guidance on their expectations, such as: OCC Bulletin 2013-29, “Third-Party Relationships: Risk Management Guidance; FFIEC Appendix J: Strengthening the Resilience of Outsourced Technology Services. And, if you’re looking for a ‘crib-sheet’ of what the examiners are likely to be looking at, there’s also OCC Bulletin 2017-7: The OCC's Supplemental Examinations Procedures for Third Party Relationships.

In February 2018, Aravo brought together a panel of experts, two of whom were former US regulators, to talk about how supervisors are thinking about third party risk management. You can listen to the broadcast here – but we’ve also distilled it down into five key take-aways.

Read More

Topics: third party risk management, tprm, supplier risk, vendor risk, occ compliance, FFIEC, third party risk regulators, regulatory frameworks, risk and compliance, third party risk, third party compliance, third party vendor, concentration risk, fourth party risk, geopolitical risk, cyber risk, information security, compliance risk

Three ways the Internet of Things and the GDPR will impact Third Party Risk

As the Internet of Things (IoT) evolves, it will offer organizations the opportunity to create an unprecedented range of potential products and services. By embedding the internet into computer systems inside of cars, appliances, and other physical things, manufacturers will be able to offer new functionality as well as additional services. Smart homes and intelligent cars are already on the consumer market in many countries. Applications for this technology in a business-to-business environment are equally promising.

Read More

Topics: cybersecurity, Data Security & Privacy, information security, cyber-security, GDPR, cyber risk, third party risk management, cyber regulation, cybersecurity regulation, internet of things, IoT

Third party scorecards: Making an improved culture of collaboration a reality

Scorecards that measure the performance of suppliers and vendors that a company contracts with have been a business tool embraced by procurement for some time now.

However, there’s an evolution underway. Increasingly businesses are recognizing that a holistic third party scorecard that also embeds risk and compliance metrics, can not only help drive continuous improvements in vendor performance, but can also help reduce the risk that third party engagements may bring to the enterprise. What’s more, scorecards can also be leveraged as a collaborative tool to help raise the collective bar of the third party ecosystem – especially in areas such as IT security.  Operational risk, Information Security and Compliance are all now stepping up to the scorecard plate.

Read More

Topics: third party risk, risk-scoring, performance scoring, third party relationships, reputational risk, organization risk, regulatory risk, regulatory compliance, data privacy, Data Security & Privacy, information security, risk and compliance

Five Top Trends in Cybersecurity Regulations

Cyber and information security is considered by some to be the biggest challenge organizations collectively face today. A recent study conducted by Juniper Research predicts the cost of data breaches to reach $2.1 trillion globally by 2019. These incidents – whether they are caused by criminals, foreign governments, or hacktivists – can be costly for organizations, distressing for consumers, and create the possibility of real systemic damage to whole industries; even nations. So, it’s hardly surprising that regulators and legislators around the world are moving into action.  

Read More

Topics: cybersecurity, Data Security & Privacy, information security, cyber-security, GDPR, cyber risk, third party risk management, cyber regulation, cybersecurity regulation

State and Federal Financial Services Regulators Apply Focus on Cybersecurity and Third Party Relationships

In a sign of what may well be coming for all highly-regulated industries around the world, US financial services regulators are in the process of significantly enhancing their cybersecurity rules, including substantial new rules impacting third party relationships.

Read More

Topics: cybersecurity, privacy, OCC, fdic, fsscc, bits, federal reserve, fsr, Financial Services, bank, information security, Data Security & Privacy