Third-party management

A 'third party', as defined in OCC 2013–29, is any entity that a company does business with.[2] This may include suppliers, vendors, contract manufacturers, business partners and affiliates, brokers, distributors, resellers, and agents.[2] Third parties can be both 'upstream' (suppliers and vendors) and 'downstream', (distributors and re-sellers) as well as non-contractual parties.[2]

Firms do not have to conduct critical activities to be considered a 'third party'; a cleaning services firm responsible for maintaining a company's office space is a third party as much as a primary supply-chain supplier. The role or size of the third party is not as important as the nature of the relationship, the criticality of its activities, the level of access it has to sensitive data or property, and a company's accountability for inappropriate actions of its third parties. A cleaning company with access to a CEO's filing cabinet represents a different but still significant risk relative to a supplier who provides a critical component to the production line.

A non-critical service provider – such as an air-conditioning contractor – operating in a country with low corruption risk may erroneously be considered a low risk. However, if that contractor has poor cyber-security and is able to submit invoices to a customer electronically across the customer's firewall, this may represent a high cyber risk to the customer company. Target Corporation's December 2013 data breach, in which approximately 70 million Target customers' credit and debit card information was stolen, highlights the cyber security risk posed by innocent third parties – even in low risk countries such as the US. Hackers exploited an HVAC contractor with poor cyber-security who conducted electronic payments with Target and thus had access to behind the firewall.[3]

Due to trends towards specialization and outsourcing, companies increasingly focused on core competencies are engaging greater numbers of third parties to perform key functions in their business value chain;[4] third-party activity is typically responsible for driving approximately 60% of total revenue.[5] This trend is creating greater numbers of critical third-party relationships throughout the economy which – in the case of companies with tens of thousands and even hundreds of thousands of third-party relationships – can become cumbersome to monitor and manage manually.

Due to regulatory requirements, third-party management is most prevalent in the financial sector. The use of third-party management systems is mandated by the Office of the Comptroller of the Currency for American national banks and federal savings associations.[2] OCC bulletin 2013–29 explicates the third-party management requirements for financial institutions. The British Financial Conduct Authority (FCA) requires, under the SYSC 8.1 'Outsourcing Requirements', that critical functions conducted by third parties must be continuously monitored.[6]

The healthcare sector also has growing regulatory requirements that require third-party management. HIPAA,[7] the Health Insurance Portability and Accountability Act, sets the standard for protecting private patient data. There are regulations around the saving [8] and storing of PHI, Protected Health Information[9] which can be even more valuable than credit card information.[10] The HITECH Act,[11] signed in 2009 requires increased privacy and security obligations and extends those obligations to business associates.

While other industries are not required by law to have third-party management systems in place, most non-financial companies are bound by anti-bribery/anti-corruption (ABAC) and other regulations.[1] Consequently, many of them manage their third parties and have adopted third-party-management solutions.[12]

Third-party management solutions are technologies and systems designed to automate the performance of one or more third-party management processes or functions. Such solutions are external-facing and designed to complement internal-facing governance, risk and compliance (GRC) systems and processes. They run on both on-premises-installed and SaaS-delivered enterprise platforms.[13]

Security ratings services (SRS), subscription services which "provide continuous, independent quantitative security analysis and scoring for organizational entities," are gaining popularity as well.[14] The market for SRS becomes increasingly competitive as providers such as BitSight and Panorays offer companies to compile different risk factors to calculate a quantitative score for vendor comparison.