{ "docId": "019dd923-5de0-76bd-a16b-1d72bab18495", "docSlug": "0b0e77be71340a95", "documentTitle": "Third-party governance and risk management The threats are real", "authorId": "Deloitte", "authorName": "Deloitte", "documentKindSlug": "consulting-deck", "documentKindLabel": "Consulting deck", "sourceTypeSlug": "strategy_consulting", "sourceTypeLabel": "Strategy consulting", "presentationDate": null, "orientation": "landscape", "aspectRatio": 1.414, "pageNumber": 23, "pageCount": 39, "prevPage": 22, "nextPage": 24, "slideType": "industry_trends", "function": "analyze_data", "density": "overcrowded", "nDataPoints": 40, "notes": "The chart displays 5 categories of initiatives across 8 industry segments.", "elementsJson": [ "headline_text", "paragraph", "bullet_list", "bar_chart_grouped", "callout_box" ], "metadataConfidence": 1, "imagePath": null, "slideHref": "/slides/019dd923-5de0-76bd-a16b-1d72bab18495/23", "deckHref": "/decks/019dd923-5de0-76bd-a16b-1d72bab18495", "deckJsonHref": "/decks/019dd923-5de0-76bd-a16b-1d72bab18495.json", "deckAnchorHref": "/decks/019dd923-5de0-76bd-a16b-1d72bab18495#slide-23", "components": [ { "bbox": { "h": 0.65, "w": 0.35, "x": 0.6, "y": 0.19 }, "kind": "callout", "text": "Deloitte point of view\nDeloitte's experience indicates that organizations have been benefiting from assurance and monitoring activities by being able to identify and remediate significant unseen risks such as non-compliance with anti-bribery legislation, lack of appropriate physical and IT security, and over-charging compared to contractual rates (in the range of 3-10 percent of total spend). Only now are organizations expanding their third-party monitoring and assurance activities to cover all risks and all third-party types, having previously focused on a particular type of risk or a sub-section of third-parties.\n\nThe organizational clamor for increasing monitoring and assurance-related activities around third-parties demonstrates growing organizational realization that the implementation of controls to manage third-party risks is not a one-time activity. Given the dynamism in the external environment as well as within their extended enterprise, organizations must continually ensure that changing conditions have not made these controls out-of-date. In addition, more and more organizations are starting to appreciate the need to continually evaluate the effectiveness of these controls to reconfirm that they are working effectively, using various monitoring mechanisms.\n\nIn particular, the lack of organizational confidence in the tools and technology used for third-party management, resulting in absence of reliable data in this area which is described in a subsequent section of this report, reinforces the need for \"other organizational assurance mechanisms\" to obtain comfort on third-party management.", "attrs": null, "subkind": "primary", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "f1f28428-635f-4254-a2c2-f4bd8e1bb07c", "frameworkName": null, "frameworkSlug": null }, { "bbox": null, "kind": "callout", "text": "The organizational clamor for increasing monitoring and assurance-related activities around third-parties demonstrates growing organizational realization that the implementation of controls to manage third-party risks is not a one-time activity.", "attrs": null, "subkind": null, "toolName": "Visual emphasis", "toolSlug": "visual-emphasis", "confidence": null, "componentId": "019dd952-0491-71ac-9db5-4fe9eb09de0f", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.35, "w": 0.55, "x": 0.05, "y": 0.45 }, "kind": "chart", "text": "Key initiatives associated with third-parties (% of respondents)", "attrs": null, "subkind": "bar-grouped", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "f84f7fc6-70a1-400f-895a-7bd4e8f36d34", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.15, "w": 0.55, "x": 0.05, "y": 0.27 }, "kind": "list", "text": "Energy and Resources (E&R): Enhancing visibility and transparency (80 percent of respondents)\nLife Sciences & Health Care (LSHC): Enhancing visibility and transparency (66.7 percent of respondents)\nManufacturing (MF): Enhancing business case and due diligence (85.7 percent of respondents) followed by more disciplined contracting (71.4 percent of respondents)\nPublic Sector (PS): More disciplined contracting (75 percent of respondents)\nTechnology, Media and Telecommunications (TMT): More disciplined contracting (46.7 percent of respondents)", "attrs": null, "subkind": "bullet", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "8ee2f6e5-604e-4a8d-800d-cde2b88c7f47", "frameworkName": null, "frameworkSlug": null }, { "bbox": null, "kind": "metric", "text": "Percentage of respondents: 85.7%", "attrs": null, "subkind": "primary", "toolName": "Quantification", "toolSlug": "quantification", "confidence": null, "componentId": "019dd952-0491-71ac-9db5-502c86d32cf7", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.06, "w": 0.55, "x": 0.05, "y": 0.19 }, "kind": "paragraph", "text": "The survey results indicate that the prioritization of initiatives to reduce third-party risk vary by industry segment. The following industries have prioritized other initiatives over enhanced assurance and monitoring of third-parties:", "attrs": null, "subkind": "paragraph", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "7cbdfac2-911d-495c-a21c-2450a06d8a4b", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.03, "w": 0.35, "x": 0.05, "y": 0.15 }, "kind": "title", "text": "Survey results by industry segment", "attrs": null, "subkind": "headline", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "bb668dc7-bde8-4203-bec8-c3a71f09ec79", "frameworkName": null, "frameworkSlug": null } ], "metrics": [], "tools": [ { "name": "List presentation", "slug": "list-presentation", "agent": null, "layer": "slide", "matchId": "bde5d853-7214-428b-83d3-ec68c4e31850", "evidence": "list/bullet: Energy and Resources (E&R): Enhancing visibility and transparency (80 percent of respondents)", "confidence": 0.7 } ], "frameworks": [], "arcBeats": [ { "to": 35, "from": 19, "beatId": "2838f766-362d-4d20-8c1e-8c578de9a277", "arcName": "The Consultant's Gambit", "arcSlug": "consultants-gambit", "beatName": "Impact & Next Steps", "beatSlug": "consultants-gambit-impact-next-steps", "evidence": "The deck provides best practices and recommendations for implementing robust governance and risk management practices", "position": 3, "confidence": 0.8, "parentBeatName": "Resolution", "parentBeatSlug": "resolution" } ], "loops": [ { "to": 25, "from": 20, "name": "Mece Breakdown", "slug": "40-mece-breakdown", "bestFor": "Problem structuring, ensuring completeness, strategic analysis", "matchId": "a9c87922-32ba-4b78-9300-fb605355b331", "evidence": "The deck provides a detailed analysis of third-party engagement risks and their criticality", "position": 1, "objective": "Provide a comprehensive breakdown of third-party engagement risks", "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage", "confidence": 0.6, "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories" } ], "imagePathAlt": null, "thumbSrc": null, "thumbSrcAlt": null, "locked": true }