JAYEN GODSE, April 2020
A successful vendor management program needs to invest heavily in the management of risks associated with third-party vendors. While doing TPRM, we generally assess risks such as Information Security and Compliance Risk. However, a one-size-fits-all approach for vendor risk management is not optimal. It must be tailored to the risks associated with specific engagement(s). This is called Inherent Risk. Inherent risk is the risk associated with a given engagement regardless of the controls the vendor has implemented. It gives you an indication of the level of due diligence you need to conduct on the vendor.
For an engagement with low inherent risk, you may choose to assess basic controls, while for an engagement with high inherent risk you may want to do an onsite audit and validate all controls.
Let’s consider two scenarios. In scenario 1, you are sending sensitive data to Amazon. In scenario 2, you are sending the same sensitive data to a little-known offshore company. Is the inherent risk the same in both scenarios?
What is Inherent Risk?
Mathematically, risk is a multiple of Likelihood and Impact.
It is the likelihood of a breach happening, multiplied by the impact of the breach on the business. In the above case, where sensitive data was sent to two different vendors, the impact was high, regardless of the vendor. If data for Likelihood is not available, you may choose to assume the same likelihood across all engagements. If you are a conservative company, you will assume a high likelihood. The likelihood of data being breached at Amazon is low, while the likelihood of data being breached at an offshore company is high.
The result is that the inherent risk in scenario 2 is higher than in scenario 1.
Inherent risk is different from Residual Risk, which is the risk that remains after assessing the controls that are implemented to mitigate the risks. This is calculated by multiplying inherent risk by the effectiveness of the control.
In this article, we are going to focus on Inherent Risk.
CATEGORIES of RISK
Inherent risk can be categorized into different areas:
Technology – the risk you face due to a failure in the vendor’s technology;
Compliance – the risk that the vendor won’t be compliant in the manner in which the data is handled;
Legal – the risk you face when the vendor does not keep up with the laws and regulations;
Privacy – the risk you face if the vendor goes out of business.
BCP (Business Continuity Process) – the risk you face if your vendor does not put sufficient controls in place to protect privacy;
The risk area to be assessed depends on the type of engagement between the vendor and the client. Once the type of engagement is determined, an inherent rating is provided.
For each area/category of risk, you will need to develop specific factors to assess the impact and likelihood. Earlier, we saw that for Cyber Security risk, the impact depends on the type of data and the volume of data accessed. The likelihood depends on how the data is accessed. Companies should develop a likelihood and impact scenario for each risk area. We have provided some additional samples below.
IMPACT and LIKELIHOOD
Impact: This will help you figure out the kind of data that can be compromised and how much data can be compromised. It gives you a sense of the extent of damage you will incur and the kind of impact that will have on your business. In some cases, it will be a financial loss that is incurred, whereas in others it might be a reputational loss. What kind of loss will be more harmful to you? How much damage can you survive? These are some areas on which you will get clarity on which loss will have more of an impact – financial/legal/reputational – and how much of the damage the company will be able to withstand.
Likelihood: – This will help you figure out the probability of a breach happening. Determining the likelihood depends on a number of factors. You can take the highest rating if you want to be conservative or you can take an average. Where is the data being accessed from? The rating is typically considered low if the data is being accessed from inside your office. The risk is considered medium if the access is offsite from a country with low CPI (Corruption Perception Index), and it is considered high in all other cases of offsite access. How is the data being accessed and/or transferred? The risk is inherently high if the access and transfer are manual, to factor in human error. In the case of automated access, the rating is considered low. In cases where the data is accessed by VDI, but there is no transfer of data, the rating is inherently medium.
QUESTIONS TO ASK:
In this part, we will cover the bare minimum for questions you need to ask to help you calculate inherent risk.
You need to know:
Access to the data: Is access to sensitive data being separated by roles and responsibilities? Is there hierarchical access and ownership of data? Or is it free for all?
Storage and protection of data: Is it in a place with open access? Are there controls in place to safeguard it?
Physical controls: Are there physical controls in place? Is the room that hosts the data locked? Is there keycard access in place?
Here’s a snapshot of some of the questions posed by our vendor risk management solutions to assess our client’s risk level. Contact us to learn more about ComplyScore’s IT vendor management services.
