Third-party catalogue

With the increasing dependence on third parties, every organisation should have a complete and consolidated overview of the parties they engage with.

The 3rdRisk third-party catalogue is a central repository that you can use to register all your third parties quickly. Per third-party, you can register different contracts, segment them on different risk profiles, assign ownership, and keep track of risk & compliance events during the time that you do business with them.

Concept

One solution
With the 3rdRisk platform, you can manage all your third parties in one module. You no longer need a separate risk/GRC solution for that.

The following graphic provides a conceptual overview of the integrated 3rdRisk third-party management module, which consists of:

• Third-party catalogue
• Contract catalogue

This module is tightly integrated with the other platform modules:

High-level concept of the 3rdRisk third-party management module

1. Identify

First, an organisation need to identify the different third parties within your organisation. A third party can be a:

• Supplier
• Service provider
• Business Partner
• Joint-venture
• Alliance
• Distributor
• Reseller
• Agent
• Contractor
• ...

In most organisations, the procurement department has the most reliable and complete overview of third parties. Although their overview does not commonly contain all third parties, it will give you a good head start for the initial input.

Start simple
Although most organisations have thousands of third parties, start with a limited set and first get a complete understanding of the platform. A good practice is to start with your 10-20 most critical third parties. You can always add and update the number of third parties at a later stage.

2. Register

After you have (partly) identified all your third parties, you can easily register them in the 3rdRisk platform.

Within the third-party catalogue, you can:

• Search for already registered and known organisations on the platform
• Leverage the Dutch Chamber of Commerce API to search for official organisations in the commercial register
• Add ALL your third-parties

Address details
Generic address details are saved in the third-party record. If you have selected a known third-party on the platform (1.) or from the KvK (2.), the system will provide these details and keep automatically up-to-date.

Contact details
The contact details are essential for the assessment module; in this section, you can specify a specific e-mail address for sending 3rdRisk assessments to the third party. This can be, e.g. the mailbox of a security team, account management or legal.

E-mail for 3rdRisk assessments
For efficiency reasons, it is advisable to ask upfront the e-mail preference of the third party for receiving 3rdRisk assessments.

Scope
Third-party scope

The organisation model is also used to define the scope of a third party within your organisation.

Third-party risk profile
Once you have established a (complete) inventory of the various third parties, you can segment them by risk level. An effective segmentation will help you determine how to utilise your third-party risk management activities strategically.

The screening process to define the risk profile needs to be well-defined and should provide input on the criticality of the third-party relationship. You can include the type of business, dependency, accessibility of sensitive information, critical VPN/remote network access, compliance requirements, business continuity, spend size and legal as factors on which a third party can be assessed.

Rules-based risk profile
The platform comes with a simple system of critical-, high-, medium-, and low-risk categories, which is already helpful for most organisations. You can also follow a score-based approach whereby you conduct due diligence across different dimensions and use the results to develop a composite risk score. Although very thorough, this approach can be cumbersome and resource-intensive for many organisations. With the rules-based approach, you identify specific rules or criteria for each segment and thereby streamline the process of assigning suppliers to risk categories. This approach is about 50-60 per cent faster than the score-based one.

3. Associated contracts

Within the contract module, you can easily register and associate one or more contracts to a third-party record.

IMPORTANT: Assessments are based on contracts.

Unlike some of our competitors, you perform assessments within 3rdRisk on one or more contracts of third parties, not a third party itself. The reasoning for this is that there can be a significant difference between one or more agreements, including different risk profiles, applicable (local) requirements and involved internal & external contact persons. But you can still assess all contracts of one third party with one assessment.

4. Monitor & respond

During the lifecycle of a third party, you can monitor the third parties in scope by:

• Performing due-diligence periodic evaluations. As the number of third-parties increases over time, one of the best strategies is to conduct due diligence based on the associated risk profiles and applicable compliance requirements.
• Monitor and act on evolving risks
• Monitor and act on incidents that may have an impact on the organisation

5. Reporting

The platform provides advanced and dynamic dashboard- & reporting capabilities which will give you continuous and real-time insights into your third-party landscape.

Add a third-party

To add a new third party to the platform:

1. Navigate to: Left side menu: Third parties - Catalogue
2. Click on the [+ Add third-party] button
3. Provide third-party details:

Required field *

4. Click [Add third-party] to add the organisation to your catalogue.

OR

5. Click on the [^] - [Add the third party & register the first contract] to add the third party to your catalogue and directly add an associated contract.

Upload multiple third parties at once (mass upload)

To upload multiple third parties at once:

1. Navigate to: Left side menu: Third parties - Catalogue

2. Click on the [Import third-parties] button

3. Click on the [Download] third-parties import template link

4. Open the Excel template and populate the rows. You can use the options as stated in the table below.

Required field *

5. Click on the [Browse] button, select the populated Excel file and upload it to the platform

6. If you do not want to add a contract for each third party manually, you need to select "Add a default contract to every imported third party". If you select this option, you must add a default contract name. 

7. If you want to assign each third party to an organisational entity of your organisational model, you need to select "Change the position within the organisation of imported third parties". If you select this open, the organisation model appears, and you can drag and drop each third party to the respective entity.

8. Click on the [Import] button

Update a third-party

To update a third party on the platform:

1. Navigate to: Left side menu: Third parties - Catalogue
2. Search for the applicable third-party you would like to update
3. Click on the sub-menu in the 'Actions column' and click 'Edit third-party'
4. Update the third-party record and click on [Edit third-party].

Remove a third-party (deactivate)

You cannot remove but only deactivate the third party in your catalogue for archiving and linking purposes. Caution: You can only deactivate the third party when no active contracts are associated in your contract catalogue. After deactivating, you will no longer be able to associate or link any contracts to this third party.

1. Navigate to: Left side menu: Third parties - Catalogue
2. Search for the applicable third party you would like to deactivate
3. Click on the sub-menu in the 'Actions column and click on the [Edit third-party].
4. Click on the red-coloured 'recycle bin'

View audit log

Data integrity is critical for your third-party catalogue; that is why the third-party management module comes with a protected audit log that registers all mutations in your third-party catalogue; it records:

• Timestamp
• Data adjustment (old value and new value)
• The user account that was used for this update

None of the platform roles (including the platform administrator) can delete or make mutations to this audit log.

To view the audit log of a change in your third-party catalogue:

1. Navigate to: Left side menu: Third parties - Catalogue
2. Search for the applicable third-party
3. Click on the sub-menu in the 'Actions column' and click 'View audit log'

Known module limitations

• The system will not yet inform you about upcoming contract end dates - this feature is on the roadmap.
• There is no export function of the data from our platform to other sources such as Excel - this feature is on the roadmap.