Trust or verify? How to assess, supervise and control third parties efficiently

What it is about

Third-party risk management is key to the continuity and reputation of any organization: outsourcing critical services also delegates operational, regulatory and reputational exposures. In an interconnected environment with growing regulatory pressure, monitoring and managing those risks is a strategic imperative to avoid costly interruptions, penalties and reputational damage.

The webinar reviews the essential elements for assessing a third party: due diligence criteria at onboarding, segmentation by criticality, continuous monitoring and risk rating, supported by self-assessment questionnaires and analysis of early indicators. It also covers how to supervise and control the relationship continuously, with differentiated KRIs, efficient reporting structures and contractual remediation mechanisms, to turn supplier monitoring into a permanent improvement cycle.

Session summary

The speaker starts from the fact that no organization operates alone: it depends on an ecosystem of third parties, and each third party that processes, stores or distributes the institution’s information exposes it to confidentiality, integrity and availability risks, with financial, regulatory, legal and reputational effects. He insists that protection is not only about technology but about the combination of people, processes and technology, and that what is really being protected is the information. He proposes a general-to-specific approach: start from critical services, identify which third parties are involved, what information they handle, what technology they use and what risks are associated, and from there define policies, governance, roles across the three lines of defense, gaps and adjustments to contracts and service levels.

In the questions he clarifies that the main mistake is to look only at the functional side of the service and forget what information the third party handles; that outsourcing does not transfer responsibility and insurance does not remove it; that independent assurance reports such as SOC 2 help but must be verified through control testing; that risk management must be integrated rather than siloed; and that only what exceeds risk appetite or could shut down the business should reach the board. He also covers periodic reassessment of risks, how to rate them high, medium and low with clear criteria, continuous monitoring of key controls and how to treat the use of artificial intelligence by third parties.

Topics covered

• Dependence on third parties and risks to the organization’s information
• People, processes and technology: protecting information, not only technology
• From the critical service to the third party, the information and the associated risks
• Policies, governance and three lines of defense in third-party risk
• Trust but verify: SOC 2 reports, control testing and responsibility that is not transferred
• What should reach the board and how often to reassess risks
• Questions: crisis communication, rating third parties and artificial intelligence