Governance and Risk
When the board asks which suppliers are critical, the answer should not take a month to assemble. We help write your supplier tiering criteria and third-party risk policy, and your leaders approve them.
Book a conversationHow IT Governance and Third-Party Risk Work, and When You Need Them
Governance decides who makes technology decisions and how those decisions are checked. Management makes them. The board or owners set direction and policy and watch performance, and management runs technology within that direction. Third-party risk management applies the same discipline to suppliers, through a cycle bank regulators describe as planning, due diligence and selection, contract negotiation, ongoing monitoring and termination. Handing work to a supplier does not reduce your responsibility for it.
When it makes sense
- Nobody can produce a complete list of your suppliers.
- You are a public company. Your annual report has to describe how you assess and manage material cybersecurity risk, and how the board oversees it.
- Suppliers hold regulated data, which brings contract terms the law requires whatever the size of your program.
- A supplier failure would hit your customers, your operations or your financial results.
When it does not
In our judgment, a full program may be more than your risk calls for when:
- You have few suppliers, none of them critical, and no regulated data. A short policy with a named owner may be all you need.
- Your program already names owners, tiers suppliers and gets reviewed. A review of what you have is enough.
- A parent company or regulator already sets the program you must follow. The work is fitting into it, not building a second one.
The program should fit the risk you carry, and sometimes that means a lighter one.
Where Governance Programs Break Down
These are the gaps to close before any framework will help.
Policies nobody owns
ISO/IEC 38500 and COBIT both call for named accountability, and NIST's Cybersecurity Framework expects roles and authorities to be enforced. A policy without an owner doesn't govern anything.
Tiering without an inventory
Ranking suppliers by how critical they are only works from a complete, current list of supplier relationships and the services each one provides. We help write the tiering criteria and your leaders approve them; the frameworks leave the number of tiers to you.
Shadow IT
Cloud services and software adopted without IT sit outside your policy. The UK's National Cyber Security Centre finds this is rarely malicious; it appears when approved tools or request routes fall short. Discovery tools help but can't see inside every encrypted service, so a fast way to ask for new tools matters as much.
Checks that aren't independent
Internal audit's assurance depends on independence from the managers it checks, and bank regulators expect independent reviews of a third-party program to confirm that conflicts of interest are avoided.
Monitoring that nobody is assigned
Ongoing monitoring runs for the whole relationship and should be closer for critical suppliers. It has to sit with a named person on your team or a specialist provider, with the reports it relies on required in the contract.
Your suppliers' subcontractors
You are not expected to oversee every subcontractor. The test is how your supplier oversees its own, how much it subcontracts and where.
Treating a SOC 2 report as the answer
A SOC 2 report is an independent auditor's examination of a supplier's controls. It is an input to your review, so check what it covers and any exceptions the auditor found.
What Supplier Risk Means for IT and Finance
For IT and risk leaders: owners and tiers
- A named owner for every policy, and a current list of the suppliers it covers.
- Tiering criteria your leaders approve, so the closest review goes to critical suppliers.
- Your policy's contract requirements carried into each bid TREU runs, so your team approves terms rather than collecting them.
For finance: exposure in proportion
- Liability caps in proportion to the loss you could suffer.
- Clear fees, with limits on how far they can rise.
- A rule on who may accept terms, click-through terms included.
What Your Policy Should Require of Supplier Contracts
Terms that governance guidance looks for in a contract, drawn from US regulatory and standards guidance and scaled to the supplier's tier. For the clauses to ask for and how to negotiate them, see our Contract negotiation page, under Manage.
-
Defined scope and measurable service levels.
The policy should require a clear scope of work and performance standards that can be measured.
-
Audit rights and reporting.
Require access to the information you need, the right to audit and regular reporting, reaching the supplier's subcontractors where it matters.
-
Fees and limits on increases.
Fees should be clear at signature, with limits on how far they can rise.
-
Data ownership and breach notice.
State who owns your data and the data the supplier generates, require confidentiality and prompt notice of a breach, and include the terms the law requires for regulated data.
-
Security in the agreement.
Write security requirements into the contract itself, rather than leaving them in the RFP or a due diligence questionnaire.
-
Liability and insurance in proportion to the risk.
Liability caps should be in proportion to the loss you could suffer, and the supplier's insurance sized to the risk of the work.
-
Incident planning with the supplier.
Relevant suppliers should take part in your incident planning, response and recovery.
-
Subcontracting and continuity.
Require consent or notice before the supplier subcontracts, set resilience and continuity terms, and consider source code escrow for purchased software.
-
Exit planned at signature.
Plan for reasonable notice, the return or destruction of your data, who pays for the transition, and the outgoing supplier's duty to hand over what a new one needs.
-
Who may sign.
Decide who may accept terms, including click-through terms, and which contracts need a higher level of approval.
This list is a starting point for your review. TREU is not a law firm. Your counsel gives the legal advice.
Your Risk Policy at Every Stage of a Purchase
See how we work-
Supplier identification
We start from your supplier inventory and risk tiers, so suppliers for critical work get the closest look before anyone is shortlisted.
-
Buying cycle
We write your policy's contract requirements into each bid and negotiate them with your counsel, scaled to the supplier's tier.
-
Implementation oversight and accountability
We hold the supplier to the dates and terms it agreed through go-live, and check the first invoice against the contract.
-
Client and supplier lifecycle management
Your team, or a provider we source, watches performance. We bring your policy to each business review and track terms and renewal dates, so every renewal is measured against it, for the life of the agreement.
Questions Buyers Ask About Governance and Supplier Risk
What is IT governance?
Deciding who holds which technology decisions, and how those decisions are checked. The board or owners direct policy and watch performance; management runs technology within that direction.
What is the difference between IT governance and IT management?
Governance decides who makes and contributes to decisions, and checks the results. Management makes the decisions and runs the work.
What is third-party risk management?
Managing the risk of work done by suppliers, from planning and due diligence through the contract, ongoing monitoring and exit. Using a supplier does not reduce your own responsibility for that work.
How should we tier suppliers by risk?
Rank them by how critical their work is to you, such as whether a failure would hit customers, operations or financial results, and scale due diligence, contract terms and monitoring to the tier. We help write the criteria; your leaders approve the definition of critical.
Do we need to manage our suppliers' subcontractors?
Not each one directly. Look at how your supplier oversees its subcontractors, how much it subcontracts and where, and require notice or consent in the contract.
Which framework should we use: COBIT, ISO/IEC 38500 or NIST?
ISO/IEC 38500 sets short principles for directors. COBIT covers governing and managing technology in more depth. NIST's Cybersecurity Framework and SP 800-161 address cybersecurity and supply chain risk. COBIT and ISO/IEC 38500 are both meant to be sized to the organization. In our judgment, start from the one your regulators and auditors already expect, and borrow from the others where they help.
Does the bank regulators' guidance apply to us?
It binds banks. For other companies, its cycle of planning, due diligence, contract negotiation, monitoring and termination is a useful model.
Does TREU write our policy, or monitor our suppliers?
We help write your third-party risk policy and supplier tiering criteria, and your leaders approve both. We don't monitor suppliers. We join your supplier business reviews and track terms and renewal dates.