The rapid digital transformation of the financial industry leaves vendor risk programs desperately trying to stay above water. At a minimum, they must match the speed of that change. Vendor risk programs must also adjust to new technologies and maintain their focus on current and older technologies. Most importantly, vendor risk programs need to help give customers the various digital services they want while keeping their data safe.
In addition to the moving parts above, there is a growing demand for digital financial services. This puts a significant stress on vendor risk personnel and the control frameworks they put in place. From data privacy to cybersecurity, there are many potential risks. These risks need to be identified, prioritized, and mitigated, costing time and money.
According to industry sources, $270 billion a year is spent on compliance related costs and the average community bank’s spending at $3.5 million per year. Financial institutions could double over the next five years, according to some sources. Surveys have found that institutions typically spend 4% of total revenue on compliance, with expected increases to 10% by 2022. On top of that, regulatory requirements are roughly the same for all financial institutions regardless of size. Smaller institutions are required to obey substantively similar requirements irrespective of the internal resources available to meet those requirements.
Determining which vendor risk issues on which to spend money can be challenging, and brings up the following questions:
- Which controls should be implemented to generate the highest levels of cybersecurity and data privacy per dollar spent?
- Which controls will be examined, irrespective of their benefit to cybersecurity or data privacy?
- How do these decisions affect your reputational, strategy, and operational risk?
Labor costs are the highest cost in business. To reduce overall spend, vendor risk tasks are frequently assigned to already overburdened employees. These personnel may or may not have experience in vendor risk. The executive suite incorrectly assumes the vendor risk program is on track and functioning because it has been assigned to an employee. Furthermore, the executive suite receives no bad news until an exam or audit occurs. This is again because the assigned employee is overburden and does not have time to work the vendor risk program.
Outsourcing due diligence analysis and other parts of your vendor risk program will ensure that the vendor risk program runs effectively and efficiently, is prepared for exams and audits, and is providing the appropriate levels of cybersecurity and data privacy. Vendors can bring personnel with high level of expertise. The executive suite will then know the vendor risk program is on track and functioning because personnel with the expertise have been allocated to give vendor risks tasks the time they require.
On average, Fortrex provides vendor risk analysis services at the cost of a part-time employee. For this investment, we provide a full team analyzing a vendor’s due diligence package, recommending risk mitigation activities, and providing context on how to effectively spend resources on protecting cybersecurity and data privacy. We track contract information, so you know you are spending only on products and services you need. Contact us to see how we can help you keep your vendor risk costs in line while keeping a handle on data privacy and cybersecurity.
