Financial institutions cannot effectively manage cyber and third-party risks if they lack visibility into how vendor controls interact with their own. A senior audit executive argues that common frameworks, active audit programs, and collaborative reviews
Financial institutions should stop
treating third-party assurance as a paperwork exercise and start using audit
rights to uncover the risks hidden within increasingly complex technology
ecosystems, the Chief Auditor, Innovation and Technology at a major European
bank has warned.
Organizations already receive large
volumes of information from critical suppliers, but gaining a true
understanding of residual risk requires a more structured approach that aligns
controls, responsibilities, and risk assessments across both parties.
Speaking at a recent industry
gathering focused on third-party risk and cybersecurity resilience, the senior
executive argued that organizations often struggle because they view vendor
controls and internal controls separately rather than as interconnected
components of a single risk environment.
"You need to align the controls
and the risk," said the Chief Auditor, Innovation and Technology at a
major European bank. "If you want a good understanding of what your net
position between what the vendor is doing for you, what you're doing, and how
that lands in a net residual risk position, you need to align your
understanding."
At the heart of that challenge is
communication. Vendors and clients frequently use different terminology,
different methodologies, and different frameworks when discussing risk.
As a result, institutions can
struggle to determine whether controls are truly operating effectively across
an outsourced service.
The speaker argued that common
frameworks provide a practical solution because they establish a shared
language that allows both parties to assess risks and controls consistently.
"The easiest way is to use a
common framework," he said. "These common frameworks will help you
get to the right position when it comes to understanding the risk."
The issue becomes particularly
important when organizations attempt to assess residual risk arising from
outsourced services. Vendors operate their own controls while clients maintain
separate controls within their own environments.
Understanding how those controls work
together is essential if firms are to make informed decisions about whether to
accept, mitigate, or transfer risk.
While many institutions have invested
heavily in internal governance and risk management frameworks, translating
those frameworks into meaningful conversations with suppliers remains
challenging.
The executive noted that vendors
already provide substantial amounts of information through controls reports,
certifications, and assurance reviews.
Those reports can offer valuable
insight into a supplier's control environment, particularly when they include
mappings to recognized industry standards.
However, he warned against treating
those documents as a box-ticking exercise.
"Don't ignore the reports,"
he said. "Do pay attention to any mapping that's available in terms of
aligning the domains, the controls, the specific things."
He recalled numerous occasions when
contract owners had obtained assurance reports but failed to review the
findings or follow up on reported exceptions.
Instead, institutions should actively
engage suppliers regarding identified weaknesses, understand the underlying
causes, and evaluate the potential impact on their own operations.
