Why prioritize third-party risks within project and enterprise risk management?

Sword GRC Blog

Why prioritize third-party risks within project and enterprise risk management?

Most businesses have been working with third parties – including suppliers, manufacturers, service providers, business partners, resellers – for many, many years, so third-party risks are hardly a new phenomenon. What has perhaps changed is the increased use of and reliance upon third parties within the extended enterprise, together with greater scrutiny on how the risks associated with third party relationships are being dealt with in a risk management context.

This short blog takes a look at what kind of risks can arise from working with third parties and considers why third-party risk management should be prioritized within an organization’s wider enterprise risk management (ERM) framework. 


Working with third parties can introduce many potential risks that businesses will already be familiar with from an enterprise risk management perspective, including, though not limited to:

Cybersecurity risk – the threat of loss or exposure as a result of cyberattack, security breach or security incident. Most organizations take cybersecurity seriously and due diligence pre onboarding or contract with a third party, plus continual monitoring can help mitigate the likelihood of incidents or their impact.

Operational risk – the risk of an organization’s ability to operate being disrupted due to third-party practices. As a safeguard, it may be that backup vendors are in place to replace critical third parties if necessary, or business continuity planning and service level agreements are in place to help minimize the likelihood of disruption or manage it.

Governance, regulatory and compliance risk – particularly important for financial services, healthcare and public sector organizations, the risk of third parties’ practices impacting upon your organization’s ability to meet legislative or regulatory requirements.

Financial risk – any risk arising from engaging with a third party that carries cost implications and negatively affects the financial performance or profitability of an organization.

Reputational risk – negative public opinion arising from third-party engagement can be detrimental, and of particular concern are third-party data breaches that may arise from inadequate data security.

Strategic risk – failure to meet business goals and objectives as a result of a third party’s engagement or activity.

“Most businesses work with third parties or outsource these days, and while that may be advantageous from a skills or resource perspective, it does bring new layers of complexity to enterprise risk management,” says Jenny Ritson-Smith of Sword GRC. “And of course, the more third parties that an organization engages with, the greater the vulnerability, as third-party operational practices and security standards are very often beyond your organization’s control. Your supply chain for instance may have access to sensitive customer data, intellectual property, financial information and the like, so effective third-party risk management is vital.

“Regulators are increasingly concerned with how third-party risk and outsourcing is being managed, with fines and penalties in place that might apply to your organization even if it was not directly responsible for an incident occurring via a third party, such as a data breach.

“Besides fines, being publicly exposed by regulators carries great scope for reputational damage. And whereas a disruption in a certain part of the world may have once stayed local, today, digitization and globalization mean that local, country-specific events may have world-wide coverage and consequences.

“Third-party risk oversight should be considered a key strategic risk, encompassing everything from supply, through to partner and alliance relationships. Questions worth considering include, do you truly understand the depth of third-party dependencies within your organization? And in order for organizations to identify and understand the scope of third-party risk exposure – how much risk is acceptable? How can it be remediated? Is good governance in place to manage it effectively within the wider realms of enterprise risk management?”


Gain transparency and a holistic view of third-party risks with Active Risk Manager, innovative technology driving world-class project and enterprise risk management.

Download brochure or book a demo.