How to Mitigate Third-Party Risks

Your vendor contract is one of your most important tools for mitigating third-party risk. Besides describing the products and services provided by the vendor, it should also contain details about how the vendor will manage identified risks, either through preventative (meant to prevent an action) and/or detective (meant to identify an action after it happens) measures and controls.

Once you've executed your vendor contract, you shouldn't merely file it away for a few years only to recover it once the renewal time comes around. Your vendor contract should play an active role in mitigating vendor risk before and after it’s signed.

Pre-Contract Negotiations in the Vendor Contract to Mitigate Risk

As you may already know, your organization has the most leverage before the contract is signed. A carefully written and negotiated contract will legally obligate the vendor to minimize specific risks. On the other hand, there is little you can do once a poorly constructed contract has been executed. As such, you must structure your contracts to proactively mitigate risk as much as possible.

Here are a few components to consider during contract negotiations:

• Specific contract provisions – Information security and privacy provisions will require your vendor to take the proper measures to safeguard your organization or customers' data. Compliance provisions compel your vendor to ensure they have the required licenses to conduct specific activities. Specific provisions should always be included to address identified risks and your vendor's mitigation of those risks.
• Insurance and indemnity – Your contract should be specific when it comes to the types and amount of insurance you require your vendor to have. It should also explicitly state that the vendor is indemnifying your organization against loss or damage resulting from the vendor's actions or inaction.
• Service level agreements (SLAs) – The contract should include a clear set of minimum guidelines (performance, timeliness, quality, etc.) for the vendor's products or services. You may also choose to specify any penalties that will be enforced if the vendor fails to meet your SLAs.
• Use of subcontractors – Make sure your contract specifies whether your vendor can use subcontractors (their third parties/your fourth parties) to provide or support your products or services. If you’re planning to allow subcontractors, consider adding language requiring the vendor to disclose all existing subcontractors and obtain written permission before adding any new ones. Also, consider adding a clause requiring your vendor to provide you with the subcontractor's due diligence documents. Consider adding a clause requiring your vendor to provide evidence of sufficient due diligence for their subcontractors.
• Right to audit – Including a right to audit clause in your contract ensures that you can review your vendor's policies, procedures, work products or other information when needed. This should allow you to inspect the vendor’s processing facilities as well.
• Ownership and license – Contracts should address the ownership of intellectual property proprietary processes, data, and any other information assets.
• Right to terminate the contract – Make sure the contract includes termination conditions. Termination for cause, such as breach of contract, is a standard clause. Consider also adding a clause allowing for termination for convenience. Don't forget to review for termination notification periods and early termination fees.
• Confirm information security practices – In addition to the previously mentioned provisions and clauses, you must confirm that the vendor has documented policies related to access management and data handling, including encryption, storing, transferring and destroying data.
• Employee training – User errors are often a leading cause of cybersecurity incidents, so it's best to validate that your vendor provides regular and effective training for its employees.

3 Tips on How to Mitigate Third-Party Risk

Third-party risk management begins with mitigating risk. Here are three tips to ensure your risk mitigation strategy is effective:

• Don't limit controls or risk handling techniques. You need to use your entire toolkit to manage third-party risk, including various risk-handling techniques such as avoiding the risk entirely or using insurance and indemnification clauses to transfer financial responsibility. Implementing preventative and detective measures can help minimize the risks. However, some risks can’t be mitigated effectively. If the benefits outweigh the risk, accepting those risks as they are might be the best option.
• Document everything. Your best efforts may be useless without good documentation since if it isn’t documented, it won't matter. This applies both to what you include in the contract and how you keep track of activities, issues and processes that take place after it is signed. Documentation is also an essential part of demonstrating your third-party risk management practice is operating as it should and that the processes are being followed.
• Keep senior management informed (and involved as necessary). When it comes to your critical vendors, your senior management should be involved in approving contracts and risk mitigation plans. And, senior management should always approve any risk acceptances or exceptions to your third-party risk management policy.

Every vendor you contract with has some level of risk you need to manage throughout the relationship. Your organization will be better protected against new or existing vendor risks when you diversify your risk management techniques both before and after the contract is signed.