Third Party Risk Assessment

A business should be well aware of the importance of completing due diligence on third parties before engaging in any transaction, even if it is for a short period of time. Third-party assessment is now more important than ever due to new regulations and guidelines. These third party poses significant compliance risks, including facilitation payment, bribery, corruption, sanctions, data privacy and more, can be introduced into a company's operation.

Some of the regulations that compel businesses to do risk assessments on third party (below list is not exhaustive)

• German Supply Chain Due Diligence Act
  
• US Federal Reserve Guidelines
  
• France Sapin II Law
  
• Singapore MAS regulation
  
• Bank of England policy
  

Every business such as banks, insurance companies, payment businesses, financial institutions etc, must conduct third party due diligence. I believe that in the years to come, we will see more stringent and mandatory guidelines from global and local regulators.

So, how can we comply and strengthen our business before the regulator knocks on our door and fines us heavily? We can either outsource it to consulting firms or establish an in-house process. In my experience, it is always preferable to expand the compliance process rather than rely on external consulting firms. As a result, I will share best practices for conducting third-party due diligence.

A Holistic Approach to Managing Third-Party Risks

1. Scope: The operating handbook should include a clear and simple definition of what constitutes an assessment.
2. Risk Factors: The process ought to list the risk category, such as anti-corruption, sanction, anti-bribery, data privacy, human rights, and Environmental Social Governance (ESG). This depends on the jurisdiction and regulatory guidelines.
   
3. Types of Risk: Country/geography, type of engagement, vendor size, web presence, red flags, and many other factors vary according to the procedure.
   
4. Risk categorization: Each vendor should be assigned a risk level high, medium, or low. Some prefer to keep one more risk category, say very high, to closely monitor such a vendor. 
   
5. Adverse Media Screening System: A good adverse media screening tool is necessary to identify red flags involving third parties and their associates.
6. Continuous monitoring: A procedure for ensuring that vendors follow all applicable contractual requirements and legal duties.
7. Training and Communication: Third-party training for all vendors or high-risk vendors and proper communication to third parties regarding business expectations.
   
8. Risk-based approach: A risk-based approach must be used when dealing with low-risk vendors.
   
9. Document Management: Complete documentation, such as contracts, screening files, reports, and so on, must always be stored in one location.

For effective implementation, a policy document or SOP outlining the procedure is necessary. Due diligence without a manual is ineffective and, in fact, leads to further challenges. The first thing regulatory authorities look for is policies, SOP, guidelines, or any other type of written document that guides the risk assessment team. Few examples of policy could be Anti-Money laundering policy, Sanction policy, Anti-Bribery policy, Human rights policy, ESG, Data Privacy and others.

Don't get confused by the terminology; each industry has a distinct name, but the purpose is the same. Some of those I am familiar with include third-party  vendors, agents, business associates, intermediaries, and suppliers. The overall approach for performing due diligence remains the same.

 

        source: google.com