54. Desde Thecaq Info

 

Role of the Audit Committee: How to Oversee 3rd Party Risk

Third party risk is growing. And so is dependence of 3rd parties. 

What are the hurdles to managing 3rd ​party risks? PwC’s Governance Insights Center provides insights: Lack of inventory of 3rd party relationships and lack of understanding of what 3rd parties are doing.

What are common third-party risks? Cyber and data security, bribery/FCPA, compliance, ethical/social/environmental issues, brand/reputation, and operational vulnerability. 

What should boards be doing? Companies are developing robust third-party risk management programs (TPRM) with 10 key elements:

1. Ongoing monitoring of third parties
2. Alignment to ERM program
3. Clear accountability via a governance model
4. Use of automation and other tech to expand scope and scale of TPRM
5. AC and board reporting of 3rd party risk landscape, on a regular cadence
6. In-depth assessment of third parties supporting critical functions
7. Accurate inventory of all third-party relationships
8. Pre and post contract processes and controls
9. Mapping of applicable regulations to third parties
10. Third-party functions formally defined, governed, controlled, measured & reported