Navex Global recently released this report titled “2017 Ethics and Compliance Third-Party Risk Management Benchmark Report.” I am always a bit skeptical of such survey data given that the results often seem to dovetail nicely with the product offering of the company publishing the survey. Indeed, a section of the report is titled “About Navex Global’s Third-Party Risk Management Solution.”
Moreover, I often wonder whether such surveys are even statistically valid. For instance, the survey was based on 427 survey respondents, with approximately 40% of respondents coming from large companies, and approximately 15% of respondents coming from the banking/financial services.
In any event, as highlighted below there are certain survey findings which caught my eye.
All reasonably informed compliance professionals understand the need for third-party compliance and the “best practices” steps including pre-engagement due diligence that should be followed. However, actually engaging in these steps may be difficult as reflected in the below survey responses. In short, it appears that business organizations are experiencing informational deficiencies particularly in terms of quality of data.
Many business organizations have hundreds, if not thousands, if not (in some cases) hundreds of thousands of third-parties and the question compliance professionals often ask is where to start. In short the answer to this should be unique to a business organization and its specific risk profile informed by a risk assessment. In any event, the below survey responses provide some benchmarks.
A main goal of course in conducting pre-engagement due diligence of third parties is to flush out information that may present red flags so that the red flags can be downgrade to pink or white upon further investigation. If the red flags remain red, the third party should not be engaged.
The below survey results highlights the type of red flags due diligence typically returns.
