{"id":36227,"date":"2022-12-19T10:34:34","date_gmt":"2022-12-19T15:34:34","guid":{"rendered":"https:\/\/ourpublicservice.org\/?p=36227"},"modified":"2022-12-20T15:04:33","modified_gmt":"2022-12-20T20:04:33","slug":"seating-third-parties-at-the-risk-table","status":"publish","type":"post","link":"https:\/\/ourpublicservice.org\/blog\/seating-third-parties-at-the-risk-table\/","title":{"rendered":"Seating third parties at the risk table"},"content":{"rendered":"\n

Federal, state and local agencies, higher education institutions and commercial organizations rely on third parties to provide products and services, and to enable the achievement of their missions. Bringing on third parties also introduces risks such as cyber and information security, compliance, financial viability and reputation issues. Recent federal executive action (Executive Order 14028<\/a>), guidance from NIST (Key Practices in Cyber Supply Chain Risk Management – IR8276<\/a>) as well as increasing vulnerabilities have prompted organizations to place a greater emphasis on third-p<\/a>arty risk management.<\/p>\n\n\n\n

At its core, this approach enables organizations to monitor and assess the risk posed by third parties based on an understood and acceptable risk tolerance. Under the overall umbrella of an Enterprise Risk Management function, organizations can synchronize management of third-party risks in a way that is commensurate with their overarching risk strategy. <\/p>\n\n\n\n

On Oct 17, the Partnership for Public Service and Deloitte & Touche LLP held a working session\u2014moderated by Deloitte Managing Director Cynthia Vitters and Deloitte Senior Manager Jeff Welch\u2014entitled \u201cA Cross-Sector Look at Third-Party Risk Management.\u201d The sessions featured panelists Thomas Brandt, chief risk officer of the Federal Retirement Thrift Investment Board, Robert Clark, chief audit and compliance officer at Howard University and Rosa Underwood, IT specialist in the Office of Information Technology Category at the General Services Administration.<\/p>\n\n\n\n

This session focused on the integration of third party<\/a> risk management into organizational systems and what synergies can be developed by applying internal risk principles to an organization\u2019s third-party ecosystem. The discussion opened with panelists sharing examples of third party risks and how they can range anywhere from breakdowns and non-compliance with service providers or supply chain disruptions affecting the sourcing of hardware. In academia, universities must factor in public and private sector responsibilities to manage third party risk.<\/p>\n\n\n\n

Takeaways on third party risk management<\/h3>\n\n\n\n

During the session, panelists emphasized the following considerations to keep top-of-mind when establishing a third party<\/a> risk management program:<\/p>\n\n\n\n