Are you considering a third-party questionnaire for your organization? With so much debate around what should be asked, and how detailed you should be, it can be hard to know where to start.
In this 5-part blog post series, sponsored by Diligent, I will consider the full range of third-party risk management. You can explore Episode 1 on third-party risk mitigation here.
Today, we consider the third-party questionnaire and I am joined by Stephanie Font, the Director of the Operations Optimization Group at Diligent, as we discuss third-party questionnaires and due diligence investigations.
It is important that every compliance professional understands a third party's risk profile to craft the right due diligence process and ensure compliance. Here are the steps you need to follow to address compliance and risk in your third-party management.
1. Questionnaire —Gathering basic information about the third party and what regulations need to be complied with.
The first step to managing third parties is to create a questionnaire to gather basic information about the third party and what regulations need to be complied with. When creating the questionnaire, it is important to understand the organization’s risk model and what it is trying to achieve. The questionnaire should be tailored to the specific risk factors the organization is trying to address, as well as the regulations that need to be complied with.
Questions should include items such as the size of the company, where they do business, and the type of relationship they have. Additionally, the questionnaire should ask questions that will alert to any potential risk factors, such as if they do business in a highly sanctioned country.
Once the questionnaire is sent and responses are received, the answers can be used to inform the next step of the due diligence process. Your third-party risk management system should automate some of the process by flagging risk factors and indicating what level of investigation is needed.
Lastly, it is important to document the process and create an audit trail that can be used for various reasons, such as compliance and internal review.
2. Due Diligence Investigation — Investigating the third party based on their answers to the questionnaire and other risk factors.
The second step of third-party due diligence is the due diligence investigation. The best approach to this investigation is to first understand the company's risk and what it is trying to accomplish. This allows the company to create a risk model and tailor the questionnaire to fit their needs. The questionnaire should include questions about the size of the company, where it does business and other risk factors that may arise.
After the questionnaire is complete, the next step is to assess the risk factors and determine the appropriate level of investigation needed. This could range from a baseline screening for sanctions list and other global databases to an enhanced due diligence investigation which involves boots on the ground to ask questions about the company's reputation and verify a manufacturing site.
Additionally, it is important to document the process to create an audit trail for internal stakeholders and regulators. This process should be tracked in a third-party risk management system to ensure everything is done correctly.
3. Documenting — Keeping records of the due diligence investigations to be used in the future.
Documenting is an important step in the due diligence process, as it helps to create an audit trail of the activities and decisions that were taken. When it comes to due diligence, it is important to keep records of all investigations that were conducted, as these records can be used in the future to defend any decisions that were taken. This allows for all the necessary information to be stored in a secure location and can even track any changes or updates to the investigations over time.
Additionally, the system can be used to flag any potential risks that come up in the investigations and it can also automate the process of deciding which type of investigation is necessary based on the risk model.
Finally, it is important to keep all documents related to the due diligence process, such as the questionnaire, investigation reports and any other relevant documents, to create an audit trail and ensure that all compliance regulations are met.
Third party due diligence is a crucial part of any compliance program. A thorough questionnaire and a detailed due diligence investigation can help organizations to mitigate risk and ensure compliance with applicable regulations.
Additionally, it is important to document the process, as this creates an audit trail that can be used in the future. With the right tools and processes in place, organizations of any size can successfully manage third party risk and create a robust compliance program.
For more information on building a robust third-party management program, explore the business case for investing in a vendor management solution here.
Listen to Stephanie Font on the podcast series here.
Learn how Third-Party Risk Management from Diligent can help your organization assess their existing approach to questionnaires and due diligence. Request a demo today.
