Third-party risk management, explained

The lifecycle

• Request. A business owner explains what the supplier will do and why it is needed.
• Classify and rate. How critical is the supplier, and how risky before and after your controls? The answer decides how much due diligence it needs.
• Screen. Check the company and the people behind it — directors and owners — against sanctions, politically exposed persons and adverse media.
• Due diligence. Ask the questions that match the supplier’s risk, and collect the evidence.
• Approve. The right people sign off, separately from whoever requested the supplier.
• Monitor and review. Re-check on a schedule set by the risk, and when something changes.
• Offboard. End the relationship with a recorded reason, and keep the history.

Size the effort to the risk

Treating every supplier the same either drowns the team or leaves critical suppliers under-checked. A tiered approach — simplified, standard and enhanced due diligence — puts the effort where the risk is. Criticality should be set by the most serious dependency, not averaged away.

Findings, conditions and exceptions

Due diligence rarely ends in a clean yes. Some suppliers are approved on conditions; others have findings that must be fixed. Track each with an owner and a date, and have someone other than the fixer confirm it is done. Where the firm decides to accept a risk instead, record why, who agreed, and when the decision expires.