Due Diligence and Ongoing Monitoring

Hi!
could you please share your thoughts and experince on the following: 
Do you schedule the frequency of the vendors' review based on the inherent risk or residual? and why? 
Thank you

Hello,

We schedule vendor performance reviews and due diligence reviews based on the inherent risk for that vendor.
The reason we use inherent risk is to ensure the residual risk remains at an acceptable level and is fresh.
Once the residual risk becomes stale we assume the vendor's residual risk is the same as its inherent risk and must be lowered with documents supporting strong security controls, financial health, and any other applicable risk domains.

I hope this helps!

Thanks, Cody.
Original Message:
Sent: 11-29-2022 02:08 PM
From: Cody Curtis
Subject: Monitoring Frequency: based on inherent or residual risk?

Hello,

We schedule vendor performance reviews and due diligence reviews based on the inherent risk for that vendor.
The reason we use inherent risk is to ensure the residual risk remains at an acceptable level and is fresh.
Once the residual risk becomes stale we assume the vendor's residual risk is the same as its inherent risk and must be lowered with documents supporting strong security controls, financial health, and any other applicable risk domains.

I hope this helps!

We base our ongoing monitoring on two key factors, the vendor type (also known as category and/or tier) = critical, significant conventional and the residual risk = low, moderate, substantial or high. A critical third party provider with high residual risk would be monitored annually.

------------------------------
Becky
------------------------------

Original Message:
Sent: 11-29-2022 02:11 PM
From: Natalia Weems
Subject: Monitoring Frequency: based on inherent or residual risk?

Thanks, Cody.

Original Message:
Sent: 11-29-2022 02:08 PM
From: Cody Curtis
Subject: Monitoring Frequency: based on inherent or residual risk?

Hello,

We schedule vendor performance reviews and due diligence reviews based on the inherent risk for that vendor.
The reason we use inherent risk is to ensure the residual risk remains at an acceptable level and is fresh.
Once the residual risk becomes stale we assume the vendor's residual risk is the same as its inherent risk and must be lowered with documents supporting strong security controls, financial health, and any other applicable risk domains.

I hope this helps!

Hi Natalia,  GM

ongoing monitoring (OGM) frequency is set on inherent risk.  It is consistent, unless the service changes.  Also Residul Risk is a snap shot of control strength and controls are dependent on people, budgets, technology and a vendors overall strategic objectives.  Therefore, a vendor's control framework is fluid. 

Also, if you use residual risk, you could overlook high risk vendors (not have them on annual OGM), since their residual risk may end up with a  low rating.  In that case, high risk vendors may be set to a 3 year OGM frequency. Certainly, this would catch the attention of Regulators.

Regards, John - happy to chat