Third-Party Oversight Strategies

Oversight Strategies

• Obtain executive sponsorship for the program and report status of reviews and issues to them and key stakeholders regularly.

• This process has to be actively managed at all times and is year round.

• A calendar of third-party reviews should be developed, published and tracked to ensure that they are completed.o Don’t schedule all reviews at one time, pace it across the year, base it

on contract dates.o Make sure you are one of the stakeholders in the Vendor Management

program at your firm and take advantage of their oversight process.• This is an evolving program that will be affected by changes in the

firm and the regulatory environment which you will need to keep an eye on.

Oversight Strategies

• Review the data collection forms and templates on an annual basis to ensure compliance with any new regulations that come up as well as changes in the firm’s Vendor Management program.

• Reach out and compare/contrast the program with like firms.• Firms will need to provide process training/refreshers to

reviewers.• Have regular meetings with reviewers to discuss process,

challenges/issues, etc. This is a great source for ideas for enhancing your program

• The other risk management teams in the firm are partners, collaborate with them to see where the firm can leverage questions, processes and controls to eliminate duplication.

Documentation Tracking

• Supporting documentation will make/break the program!

• You have to be able to back up attestations with hard facts.

• Make sure the firm retains the documentation in a secured location where access is on a need to know basis.o SharePoint and Lotus NOTES are a great tool for this

• Apply the firm’s document retention policies to the content to make sure the firm remains in compliance.