Risk Assessments

Thanks for the feedback on risk ratings! I love the variety in responses.

Before moving over to the hospitality industry, I had been in banking for 23 years at a small, medium, and large FI. Previously I would have set up an ERM risk framework with five risk levels, which are calculated based on impact and likelihood of the underlying risks, with control effectiveness in there. Then I would have set five third-party risk tiers. That decision would have mostly been based on the direction of the industry and the large FI's. However, I'm now facing an interesting challenge to keep it simple, since we aren't regulated much at all in hospitality, outside of OSHA and such.  I really like the point of stepping back and questioning what due diligence or monitoring activities would be performed on a medium vs. medium-high third party. It can seem like splitting hairs at time. However, if the third-party filtering or segmentation process is good, perhaps you can weed out third parties that provide de minimis risk, leaving a smaller number to spread across three ratings.

Hey Bradley! I recall meeting you at the FSR vendor management conferences... I'm back in TPRM and excited.

Thanks all.

Tim Barthold

Director of Compliance and Operational Risk

Information Classification: ll General

I have always held to the opinion that a 3-level system was not granular enough and that 5 levels was something that most operational managers could conceptually understand and embrace.  I also disliked the subjective ambiguity of 'H, M,L' frameworks - since Board members, auditor, and managers all came from differing perspectives!

Since risk rating and metric information should ideally be assessed as close to its source as possible, it was important to me that non-risk managers be able to buy into the program.  In a prior position (with general operational risk responsibilities), I developed this rubric as a reference for managers to use in their assessment decision making as part of the program.  By incorporating numeric values, I could then leverage the scalar nature of the ratings with spreadsheet or database math to help me with the enterprise goals of the program.

I hope that helps!

Lee Beachy

We did it the same way. We used Critical, Significant and Insignificant.

Correct. I was not clear on my first response.

Significance of vendor is Critical, Significant and Insignificant.  Risk Rating is High, Medium, Low or Insignificant.  Significant can have a risk rating of High, Medium or Low. Critical is always High and Insignificant usually carries a risk rating of Insignificant.