Tag: TPRM

Categories
FCPA Compliance Report

Alastair Parr on New Developments in TPRM

Welcome to the award-winning FCPA Compliance Report, the longest running podcast in compliance. In this special episode, I am joined by Alastair Parr, SVP of Global Products & Delivery at Prevalent to discuss developments in third-party risk management.

In this episode we consider:

  • Why is a comprehensive 3rd risk management solution not simply a nice to have but a must to have now?
  • Why is 3rd party risk management so much critical after the pandemic and the Russian invasion of Ukraine?
  • Improving the UX for TPRM.
  • Why has simplifying the UX for TPRM eluded most providers so far?
  • How can the UX be improved so the information which is the most vital and most relevant is captured and more importantly can be actioned?
  • How can the process of obtaining TPRM information to implementing controls to manage the risk be improved?
  • How can companies automate data gathering by using a single targeted assessment by building in targeted compliance mappings for legal or regulatory requirements?
  • Other areas of compliance such as modern slavery and human trafficking?
  • Do you see continued evolution of 3rd party risk management into 2025 and beyond?

Resources

Alastair Parr on LinkedIn

Prevalent

Being a Compliance Officer is Awesome on Amazon.com

Categories
Innovation in Compliance

You Can’t Outsource Risk with Sandeep Bhide


 
Sandeep Bhide is the Vice President of Product Management at ProcessUnity, a company that is making good governance, risk, and compliance (GRC) practices and tools available to organizations via third-party risk and cybersecurity program management tools. Tom Fox welcomes him to this week’s show to talk about their Third-Party Risk: A Turbulent Outlook Survey report and how ProcessUnity helps their clients.
 

 
The Purpose of ProcessUnity
Tom asks Sandeep to explain the basis of ProcessUnity and the key products and services they are offering. Sandeep says that the company offers cloud-based solutions that provide help for organizations of all sizes, that allows them to automate their risk and compliance programs. He adds that it is an easily customizable program that reduces manual administrative tasks and allows customers to focus on “the more strategic risk mitigation activities”. ProcessUnity has the ability to review the company’s GRC program and deliver great results quickly. 
 
Third-Party Risk: A Turbulent Outlook Survey Report 
Tom wants to know what was the intent behind this report and how it came to fruition. Sandeep states that the objective of the study was to determine how well organizations understood and managed risk associated with their third-party partners. 301 IT and cybersecurity decision-makers and influencers participated in the survey, and they were asked about their concerns and challenges when managing certain risks, and how it has impacted the security incidents related to their third-party partners. Sandeep shares the overall findings of the survey found that: 

  • Third-party relationships continue to expand exponentially; 
  • Companies continue to seek outsourced services and software in order to perform optimally and to replace talent and supply sources due to the pandemic;
  • The majority of respondents have experienced an IT security incident over the last two years because of a third-party relationship. 

 
The Gathering Storm
Tom asks Sandeep to explain the concept of “the gathering storm” and the technological solution ProcessUnity provides to help navigate it. Sandeep explains that the term refers to a supply chain attack executed by “close third-party relationships that have either physical or network access to equipment and premises and those that provide software vital to a business’ operation.” Sandeep then warns that companies should vet these third parties since their role is so important. Most companies would rather focus on their core businesses, however; they feel it doesn’t make economic sense for them to do everything themselves and third parties provide the types of talent they need to properly conduct their business. Sandeep comments that “companies can outsource the work which is an imperative for them, but they can’t outsource the risk”. To manage your third parties, you must have multiple in-house and out-house methods to vet them, including questionnaires or assessments. You have to get to know your partners because they have the most risk attached to them.
 
Resources 
Sandeep Bhide | LinkedIn | ProcessUnity
 

Categories
Innovation in Compliance

Managing Compliance Complexity with Mac Bartine


 
Mac Bartine is the CEO of SmartRIA, a market-leading compliance software platform. Tom Fox welcomes him to this week’s show to talk about his company’s services and contributions to the compliance sector, what SmartRIA offers clients in terms of cybersecurity, and the future of technology solutions.  
 

 
The Minimum Viable Product
The Minimum Viable Product (MVP) is the first part of the startup process for platforms. It is recognizing the problems within your platforms and also believing that you can solve them. Mac explains to Tom that the problem SmartRIA solution identified in terms of the MVP is the compliance obligations. So many individuals are not experienced in managing compliance in their given industries, and so need a source of structure that understands where they are. SmartRIA offers them that, as well as the tools and frameworks needed. 
 
Vendor Due Diligence & Data Governance
Vendor due diligence and vendor management are key to managing cybersecurity risk. “You have to understand who you’re working with and what precautions they’re taking as a business to protect you from cyber risk,” Mac tells Tom. Having access to the proper documentation that reflects this is also important. SmartRIA has a plethora of different policies and procedures to protect clients’ data and takes the lists of vendors their clients have and itemizes each risk. Data governance falls under the same bracket as due diligence, that is, who has access to the vendors and what devices they use to access the data from those vendors.
 
SmartRIA as an SEC Solution
The solutions that you use for compliance obligations have to be done in a way that documents everything as it happens. “If it isn’t documented, it didn’t happen,” Mac says. Internal auditors aren’t in the position of giving the benefit of the doubt because they have no evidence of due diligence. SmartRIA has the tools to help its clients through this by way of PDF files, workflows, and documents. 
 
To The Future
Tom asks Mac what the future will be like for technology solutions. Regulations in every industry are going to increase. “Across every industry, there is an increasing need for cybersecurity-related evidence, and tracking of what’s happening in that space,” Mac says. Data governance and vendor due diligence are big parts of that, but compliance management is going to also become more important.
 
Resources
Mac Bartine | LinkedIn | Twitter 
SmartRIA
 

Categories
Innovation in Compliance

Exiger on the Evolution in Supplier Compliance in COVID – Third-Party Party Risk Management Solutions with Erika Peters and Skyler Chi


Welcome to the fifth and final episode of a special five-part podcast series, sponsored by Exiger, on topics From Third-Party Risk Management to Supply Chain Risk Management: Exiger on the Evolution in Supplier Compliance in COVID. Exiger was founded to fight financial crime, fraud and terrorist financing by introducing technology-enabled solutions to the market’s biggest supply chain, risk, investigation, litigation, and compliance challenges. A global authority on risk and compliance, Exiger serves the world’s largest banks, Fortune 1000 companies and government agencies and regulators. Over the past five episodes, we have put a spotlight on Financial Institutions with Tara Loftus and Samar Pratt; focus on corporations with Aaron Narva and George ‘Ren’ McEachern; consider the Federal Government and Supply Chains with Carrie Wibben and Vishnu Anantatmula; review the pillars of good compliance with Brandon Daniels and Carrie Wibben; and end with a review of third-party risk management solutions with Erika Peters and Skyler Chi.
Today, Part 5, we conclude with a review of third-party risk management solutions with Erika Peters and Skyler Chi. Peters is an Associate Managing Director based in Exiger’s New York office, where she focuses on the firm’s financial crime compliance and assurance practices. Chi is an Associate Director based in Exiger’s New York office. With nearly ten years of forensic accounting and investigative experience he leverages world-class technology (e.g., SQL, Python, Tableau, natural language processing and machine learning) in order to aid in financial investigations and government clients in bank/investment statement reviews and analyses, data analysis efforts, large document analyses, and extensive e-mail reviews.
For more information on Exiger, click here.
For more information on Erika Peters, click here.