Inherent Risk Types Involved in a Vendor Risk Assessment

Tailor Risk to the Vendor

Inherent risk considers the different risk types and amounts associated with the product or service. Vendors have their own unique risk profiles. For example, an outsourced call center would raise different concerns than your organization’s shredding company. It’s essential to understand each of the different types of risks. Let's look at the risk most identified during the inherent risk assessment.

• Strategic Risk: Occurs when a prospective or current third-party vendor's decisions and actions are incompatible with your organization's strategic objectives.
  
  Ask the question:
  
  • Is this vendor going to operate in a manner consistent with our organization's practices and strategic objectives?
• Operational Risk: Broadly defined as the risk of loss resulting from a third-party vendor's ineffective or failed internal processes, people, controls or systems. Internal operational risk is directly influenced by people (e.g., mistakes or failures due to the management and employees' direct actions or decisions).
  
  Ask these questions:
  
  • Does the vendor have suitable policies and processes?
  • Do they properly train their employees?
• Business Continuity Risk: Occurs when an adverse event affects your third-party vendor's ability to conduct business and impacts your organization as a result. These events could include natural disasters, severe weather events, fires, utility outages, civil unrest, cyberattacks, pandemics, military actions or acts of terrorism. These events are usually beyond the third-party vendor's control; however, the third-party vendor should anticipate and document a plan for if and when these events occur.
  
  Ask the question:
  
  • Does the vendor have a documented and tested business continuity and disaster recovery plan?
• Compliance and Regulatory Risk: Arises from a third-party vendor's failure to comply with laws and regulations governing the products or services provided to your organization or its customers. Compliance can also occur when your third-party vendor doesn't follow your internal policies, procedures, business standards, or codes of conduct.
  
  Ask these questions:
  
  • Does the vendor have a sound set of policies and procedures?
  • How has the vendor performed in recent exams or audits?
• Information Security and Privacy Risk: Information security risk stems from third-party vendor information security vulnerabilities and can happen when your vendor has access to your organization's or its customer data, networks or even physical facilities. Cyberattacks and data breaches are two of the most common information security risks resulting from missing or ineffective controls. Your vendors must be able to safeguard the data entrusted to them. Privacy risk is closely related to information security risk but can also occur when a vendor uses or accesses sensitive or confidential data in a way not consistent with the intended and permissible use.
  
  Ask these questions:
  
  • Does the vendor have an independent third-party audit report or certificate (SOC, ISO or other)?
  • Has the vendor experienced any breaches or other information security or privacy events in the last three years?
  • Does the vendor have an aggressive and proactive process to detect or prevent information security issues?
  • Does the vendor have a documented privacy policy?
    
    
• Reputation Risk: Reputation risk incorporates the various ways your third-party vendor could directly or indirectly damage your reputation, brand, or company name. This harm could result from their actions, poor service, lawsuits, outages, fraud or data breaches. Your reputation could also be damaged if a third-party vendor misrepresents their relationship with you directly or by using your logo or organization name.
  
  Ask these questions:
  
  • Does this vendor have a history of unresolved customer complaints?
  • Has this vendor had negative news and media attention?
  • Are there any ethical concerns regarding this organization or its owners or parent company?
• Financial and Credit Risk: Financial and credit risk are directly related to the vendor's financial condition. Suppose the vendor has insufficient investor funding, cash or credit available to meet their contractual obligations. In that case, there’s a risk they won't be able to provide products and services to your organization.
  
  Ask these questions:
  
  • Does the vendor have a robust financial outlook?
  • Does the vendor have enough operating funds to service your organization for the contract duration?