h1. Bootstrap heading
h2. Bootstrap heading
h3. Bootstrap heading
h4. Bootstrap heading
h5. Bootstrap heading
h6. Bootstrap heading
You can use the mark tag to highlight text.
This line of text is meant to be treated as deleted text.
This line of text is meant to be treated as no longer accurate.
This line of text is meant to be treated as an addition to the document.
This line of text will render as underlined
This line of text is meant to be treated as fine print.
This line rendered as bold text.
This line rendered as italicized text.
attr
HTML
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Integer posuere erat a ante.
Donec id elit non mi porta gravida at eget metus.
Quantifying inherent risk for third parties is one of the most important aspects of a best practice Vendor Risk Management program. Inherent risk – the amount of risk that exists before controls are put in place – is a calculation that can be used throughout the vendor risk lifecycle. Examples include:
When implementing an inherent risk scoring system for your vendors, here are three tips to consider:
Chances are that the person or department requesting a new supplier or service will have a good handle on how critical the vendor is to business operations. Leverage that knowledge and capture it as part of the vendor request process. Include gating or intake questions in your vendor request form, portal or process – questions whose answers paint a clear picture of a potential vendor’s riskiness to your firm. By involving “the business” in the vendor inherent risk calculation, you build a risk-aware culture while also getting a clearer picture of the risks that need to be mitigated.
It’s important to include the right questions in your internal inherent risk questionnaire. Every organization has different risks to contend with. Be sure to consider these nine risk areas when determining which questions to include in vendor service requests:
Learn More: Download our expert guide, How to Quantify and Manage Inherent Risk for Third Parties, for more details on risk domains and how to build an effective inherent risk questionnaire for your organization.
You have the right intake questions on the vendor request form, and you have business users helping you answer the questions. Now, take it one step further: Assign point values to your questions and build a scoring system that determines which risk tier each of your vendors belongs to. Organizations must determine a point system that makes sense for their business – each response must be aligned to a specific variable, score or value (point, letter, etc.) and weighed accordingly.
This step requires some work; but if done correctly, you’ll have a world-class classification system that you can use throughout the third-party risk lifecycle – initial vendor due diligence, onboarding, ongoing monitoring and more.
Here’s an example of an inherent risk questionnaire completed as part of a request to onboard a records shredder company:
Based on the answers to the intake questions (and the resulting scores), this vendor sits in the high-risk tier for this organization.
Inherent risk scoring and risk-tiering your vendors will also help prioritize where to focus your time and energy when resources are tight. Obviously, the most critical vendors should get your utmost attention. Vendor risk classification can also be used to make a business case to get additional resources – in the forms of software tools, consulting help or outsourced assessment work – when you fall behind.
Quantifying Inherent Risk for Your Vendors Requires Rigor
It’s impossible to avoid risk altogether. Inherent risk is just that — inherent. However, with an effective methodology for quantifying inherent risk, you can mitigate risk as much as possible and protect your enterprise. Objectively judging the risk any given vendor poses is key to protecting the information for which your company is responsible.
Take the next step: Our experts put together a detailed guide for organizations looking to improve their inherent risk calculations. Download How to Quantify and Manage Inherent Risk for Third Parties for real-world advice on developing a quantification methodology that will guide your company to a better and more effective third-party risk management program.