Blog

The shift to third-party management (TPM): What is TPM and why does it matter?

January 25, 2022

What is third-party trust management?
Different third-party trust management tools
Who does third-party trust management matter to?
Best practices for TPTM
How can OneTrust help with TPTM?

As the security landscape has evolved, organizations have opened themselves to more risk vectors than ever before — and that number will only continue to climb. Traditionally, the corporate vendor ecosystem — the community of third parties a company shares information with — is analyzed under the lens of third-party risk management (TPRM). More recently, the third-party risk community has seen a major shift to emphasizing the criticality of Ethics and ESG (environmental, social, and governance), pushing risk and security professionals to reconsider the way these implementations are managed.

As a result, a fundamental shift from Third-Party Risk Management to Third-Party Management (TPM) has begun.

What is third-party trust management?

Trust-First Third-Party Management (TPM) is the next evolution of third-party risk and a facet of overall enterprise trust strategy. It goes beyond cybersecurity and focuses on building trusted and lasting third-party relationships across the core critical risk domains: security, privacy, ethics & compliance, and ESG. Specifically, Third-Party Management (TPM) is a discipline of enterprise trust that focuses on the impact a third party has on an organization across each pillar.

Download the eBook to learn more about the shift to Third-Party Management and what it means for your business.

Defining the pillars of third-party trust

As consumer wants, shareholder needs and due diligence expectations for businesses have evolved, modern third-party risk considerations need to consider ethics and ESG as key risk domains in addition to security and privacy. Here’s a deeper look at each category under the TPM umbrella:

Security: Security encompasses two key focus areas, Governance, Risk, Compliance (GRC) and Vendor Risk Management (VRM). In TPM, security considerations focus on the identification, analysis, and mitigation of cybersecurity risks as it relates to third parties.
Environmental, Social, and Governance (ESG): ESG and Ethics programs are emerging as key components of a cross-organizational strategy. In TPM, ESG considerations focus on analyzing the reputational risk of working with a third party or supplier as it relates to Environmental, Social, and Governance concerns.
Ethics: Ethics, like ESG, is emerging as a key component of business strategy. In TPM, ethics considerations focus on conducting compliance checks and screening third parties as well as continuously monitoring them for concerns relating to adverse media as well as issues around corruption, politically exposed persons (PEP), sanctions lists, and beneficial ownership.
Privacy: Privacy encompasses a wide array of subject matter, with a key focus on Consent & Preference Management and Data Governance. In TPM, privacy considerations focus on the protection of personal data and demonstration of compliance as pertains to personal information with an organization’s third parties.At its core, Third-Party Management is about bringing these pillars together to gain a holistic understanding of all risk and opportunities relating to a third party.

Download the eBook to learn more about the shift to Third-Party Management and what it means for your business.

What are the different third-party trust management tools?

While TPM focuses on breaking down siloes and aligning workflows across teams, it’s important to consider that third-party security and privacy analysis may require a different set of functionalities than those focused on analyzing the ethics or ESG risk relating to a third party. Third-Party management programs require solutions that fit the individual needs of involved stakeholders, while still enabling seamless data sharing and collaboration. TPM considers the following tools as key facets of broader trust management software:

Third-Party Risk Management Software: Third-party risk management software empowers reassessment and risk monitoring by focusing on reducing security and privacy risks, solving challenges such as automating vendor security and privacy assessments, managing and monitoring your vendor inventory, and streamlining risk mitigation. TPRM software enables a business to conduct risk assessments, implement AI questionnaire autocompletion, streamline risk mitigation workflows and automate recordkeeping to meet the needs of security and privacy professionals across the enterprise.
Third-Party Due Diligence Software: Third-party due diligence software empowers due diligence monitoring by focusing on ethics & compliance risks, helping to automate onboarding, conduct compliance checks and screening, analyze risks, provide treatment plans, and maintain ongoing oversight by monitoring key concerns, such as adverse media. TPDD software enables a business to stand up onboarding automation solutions, compliance checks, vendor screening, risk analysis, treatment plans and contextual alerts to meet the needs of ethics professionals across the enterprise.
Supplier Sustainability and Responsibility: Supplier sustainability and responsibility software empowers supplier ESG monitoring by focusing on flagging ESG risks, helping organizations to understand and monitor the sustainability and responsibility initiatives of their suppliers in order to inform internal ESG program metrics as well as generate public-facing ESG reports. Visibility into supplier sustainability and responsibility enables a business to stand up ESG assessment technology, understand and track industry standards, conduct reputation risk analysis and implement targets and scorecards to meet the needs of ESG professionals across the enterprise.

Currently, third-party risk management tools are siloed and static, operating independently of one another and through manual processes. TPM focuses on the value of a singular workflow across the enterprise and encourages the implementation of a comprehensive approach, encouraging businesses to move away from spreadsheet-based work. Third-Party management also calls for the centralization and customization of workflows so each team is able to access the specific information needed to execute role-specific tasks efficiently.

Who does third-party trust management matter to?

Your third parties reflect your organization’s value. As a result, third-party management has wide-ranging implications.

Consumers: Consumers are increasingly skeptical of the brands that they engage with. Especially when it comes to commoditized goods, being a trusted brand gives you a competitive advantage with consumers by increasing their confidence in your treatment of their data, their privacy, their communities, and the environment.
Employees: Employees have more choice of how, where, and what they work on. This empowers talent to be increasingly selective about the brands that they represent. Individuals have an increased focus on their personal brand, and that aligns with not only where they shop, but also the companies that they work for, meaning that they’ll seek out brands who understand the impact of both their internal actions and the impact that a brand’s third parties and partners have on their community.
Investors & Partners: As trust increases and brand reputation stays a key factor in market valuation, partners and investors are holding brands they work with to higher standards and levels of accountability than ever before. Investment trends show that this will now exceed expectations in the realm of privacy and security and reflect those of trust.

Best practices for TPTM

When actioning TPM across the enterprise, there are 5 important steps to consider:

Define what trust means to your business: What’s acceptable to your business? Define your business needs and what trust expectations you have. Do you need a formal committee or process that reviews third parties across numerous risk domains? Do you understand what risk looks like throughout the entire third-party lifecycle? Do your vendor contracts take into consideration trust metrics you care about, such as sustainability or ethics? Most importantly, is the organization in alignment with the answers to these questions?
Define your risk appetite across domains: What are your company’s trust priorities, and what matters most to your ideal buyer? What is your weighted scale across the domains of security, privacy, ESG and ethics? How do you implement and measure that effectively?
Tier your third parties: any organizations tier third parties into three categories — low risk, moderate risk, and high risk — using a number of different factors, such as:
- Are you sharing proprietary or confidential business information with the vendor?
- Are you sharing personal data with the third party?
- Are you sharing sensitive personal data with the third party?
- Are you sharing personal data across borders? e. Is the vendor serving critical business functions?
- What is the potential effect to your organization in the event of unauthorized disclosure of information?
- What is the potential effect to your organization in the event of unauthorized modification or destruction of information?
- What is the potential effect to your organization in the event of disruption of access to or use of the third party?
- What potential ESG impacts are involved with working with the third party?
- What potential ethical or reputational impacts are involved with working with the third party?
Establish processes and automate workflows: Workflows should be customizable, can vary by the third party, and are made possible by technology. Moving away from manual, static processes is the best way to streamline your TPM process across all domains and stakeholders considered.
Vary your assessment depth: Ensuring that there is variation in your assessment depth is key to implementing a comprehensive TPM strategy. One-size-fits-all assessments are resource-intensive and often leave out key information when applied across domains. Automating your workflows will enable your organization to reduce repetition and customize assessments per risk domain, ensuring the correct depth is achieved based on how the vendor responds.

Download the eBook to learn more about the shift to Third-Party Management and what it means for your business.

Examples of TPTM workflow automation

How can OneTrust help with TPTM?

Third-Party Trust Management is the next step for Third-Party Risk Management. It goes beyond cybersecurity and focuses on building trusted and lasting third-party relationships across the core critical risk domains: security, privacy, ethics & compliance, and ESG. OneTrust offers technologies that enable organizations to build word-class Third-Party Trust programs by bringing together multiple stakeholders across disciplines to streamline workflows, reduce time spent on manual and redundant processes, and build trust with third parties. To do so, the OneTrust platform leverages expertise in privacy and data governance, GRC and security assurance, ethics and compliance, and ESG.

Blog

The shift to third-party management (TPM): What is TPM and why does it matter?

Table of contents

What is third-party trust management?

Defining the pillars of third-party trust

What are the different third-party trust management tools?

Who does third-party trust management matter to?

Best practices for TPTM

Examples of TPTM workflow automation

How can OneTrust help with TPTM?

You may also like

Third-Party Risk

Unpacking global regulatory frameworks to enhance third-party operational resilience

Register for this OneTrust webinar to learn about the relevant resilience focused requirements of DORA, NIS 2, and other global regulations.

December 11, 2024

Technology Risk & Compliance

Understanding the NIS 2 Directive: Compliance insights and best practices

This DataGuidance webinar explores the latest and expected developments in the implementation of the NIS 2 Directive, focusing on practical compliance strategies to ensure your organization is prepared.

December 04, 2024

Third-Party Risk

Rise above risk: Third-party management in technology

November 21, 2024

Privacy Automation

Defining a new direction for data

As AI continues to offer unparalleled opportunities for business innovation, it also presents risks that organizations must tackle head-on through scalable governance programs that span multiple data sources. Six key trends are defining these challenges.

November 13, 2024

Third-Party Risk

Bill S-211: Will you be ready by May 31?

In this webinar, our experts will discuss the Canadian regulation and others like it globally, while providing actionable insights into building a robust and mature Third-party program.

November 07, 2024

Third-Party Risk

Tackling IT security risks for banks in South Africa

Join our OneTrust webinar on tackling IT security risks for banks in South Africa. Explore strategies for safeguarding sensitive data, ensuring POPIA compliance, and managing cyber threats. Gain actionable insights to strengthen your security posture and build customer trust.

October 31, 2024

Privacy Automation

Build resiliency and operationalize compliance with OneTrust: Fall product release recap, 2024

Join our upcoming product release webinar to explore how these new capabilities can help your organization navigate complex frameworks, streamline third-party management, and accelerate AI and data innovation.

October 22, 2024

Third-Party Risk

Live Demo EMEA: Building a robust third-party risk management program with OneTrust

Join to explore how OneTrust's TPRM solution can revolutionize your third-party risk management approach. We will cover best practices for implementing and leveraging the software to minimize risks.

October 10, 2024

Third-Party Risk

Simplifying vendor risk management

Streamline third-party relationships and avoid common mistakes in the process.

October 03, 2024

Third-Party Risk

Essential checklist for simplifying third-party risk management

Third-party management doesn’t have to be a complicated process for your business.

October 02, 2024

Third-Party Risk

Navigating risk in financial services with third-party management

Working with third parties introduces privacy and security risks, making compliance and business growth a balancing act.

October 01, 2024

Third-Party Risk

Manufacturing risk: Managing third parties in the supply chain

Third-party management keeps manufacturing operations running smoothly by verifying vendor and supplier compliance with regulations.

September 30, 2024

Third-Party Risk

The complete guide to third-party management

It’s imperative for security teams to implement a holistic approach to third-party management.

September 27, 2024

Third-Party Risk

Strengthen your third-party ecosystem: Strategies to combat modern slavery, anti-bribery, and corruption

Join our upcoming webinar to learn how to navigate the complexities of managing modern slavery, anti-bribery, and corruption within your third-party ecosystem.

September 26, 2024

Third-Party Risk

PDPL and third-party risk

Join us in a webinar where we will discuss PDPL, third-party risk, and compliance best practices. Learn how you can automate and simplify your third-party management program with OneTrust.

September 19, 2024

Third-Party Risk

APAC - Third-party risk management and due diligence: What’s the difference and why does it matter?​

Join this APAC webinar to learn the unique competencies of third-party risk and due diligence programs and examine when and how to align them to maximize the effectiveness of each.

September 18, 2024

Third-Party Risk

Navigating the intersection: Third-party risk management in South Africa's evolving data landscape

Amidst South Africa's dynamic AI terrain and evolving data privacy regulations like POPIA, mastering third-party risk management is paramount. This session explores the balance between AI innovation and data protection.

September 18, 2024

Third-Party Risk

Third-Party operational risk: Shifting from reliance to resilience

APAC - Third-party risk management and due diligence: What’s the difference and why does it matter?