Taking Ownership of Vendor Risk Management (VRM)
By Sarah Shannon
Too often, carrying out due diligence around vendors is seen as nothing more than a tick box on a list of things to do. But in today’s business environment where every business is linked to the global supply chain disruptions and other problems can originate from the weakest link in your supply chain.
It is possible to eliminate vulnerabilities, mitigate new risks, and make informed decisions when you manage vendors properly. In doing so your business has clarity over which vendors to work with (and which to stop working with). In other words, VRM should be an essential part of any organisation’s risk management strategy.
Before you can begin reaping the benefits of Vendor Risk Management, your organisation needs to take ownership of the process. Here’s how to get started:
1. Define what you want to measure.
The first step in taking ownership of VRM is to define what risks you want to measure.
Do you want to measure cyber security risks? Legal risks? Regulatory risks? Privacy risks? IT risks? Business continuity risks?
All of the above? Once you’ve identified the types of risks you want to measure, you can begin to capture the information you need to make informed decisions about your vendors.
2. Take ownership for VRM.
The next step is to take ownership for VRM within your business. This means making sure you have the right expertise and resources in place to manage vendor risk effectively. Answer the questions below to
- Do you have a dedicated Vendor Risk Managment team?
- Do the team have the capacity to manage vendor risk appropriately?
- Does your business have the tools required to track and automate the process?
- Does the team have a secure way to exchange documents with vendors?
If the answer is no to any of the questions, now is the time to make changes and safeguard the business.
3. Set realistic goals.
Once you’ve taken ownership for VRM, it’s important to set realistic goals for the process.
- What is your ideal outcome?
- Is it simply to comply with regulations?
- Or is it something more ambitious, like eliminating all vulnerabilities or mitigating all new risks?
Whatever your goal may be, make sure it’s something that’s achievable and that everyone in your business buy into it.
4. Build trust and understanding.
Finally, remember that Vendor Risk Managment is not a one-off exercise – it’s an ongoing process. This means building trust and understanding with your vendors so that they become partners in your Vendor Risk Management strategy.
When everyone is working together towards a common goal, you are more likely to achieve success and do business better.