Past vs. Present: Third Party Risk

Size: px

Start display at page:

Download "Past vs. Present: Third Party Risk"

Augusta Bryan
8 years ago
Views:

1 Past vs. Present: Third Party Risk Kevin O Sullivan and Hicham Chahine 3 rd Party Risk, Crowe Horwath LLP April 30th, 2015

2 Agenda Drivers pushing Third Party Risk Past vs. Present Events and Trends Vendor Management Process Risk Assessment Controls Assessments Ongoing Management Vendor Review Monitoring Recommendations Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 2

Assessment Controls Assessments Ongoing Management Vendor Review

3 2015 Vendor Risk Management Headlines Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 3

4 Drivers of Third Party Risk Market Drivers: Substantial reliance on third parties Incomplete populations of vendors or vendors with sensitive data Inconsistent risk assessment and review practices across organizations Complexities in managing third party risk: Identifying what risks really matter Selecting which third parties to review Taking effective action when an issue is found Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 4

Complexities in managing third party risk: Identifying what risks really matter Selecting which third parties

5 Drivers of Third Party Risk Regulatory Drivers Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 5

6 New York State Driver Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 6

7 DFS Letter to NY State Banks Describe any due diligence processes used to evaluate the adequacy of information security practices of third-party service providers. Provide a copy of any policies and procedures governing relationships with third-party service providers that address information security risks, including setting minimum information security practices or requiring representations and warranties concerning information security. Describe any steps your institution has taken to adhere to the Framework for Improving Critical Infrastructure Cybersecurity issued by the National Institute of Standards and Technology (NIST) on February 12, 2014 concerning thirdparty stakeholders. Describe any protections used to safeguard sensitive data that is sent to, received from, or accessible to third-party service providers, such as encryption or multi-factor authentication. Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 7

practices or requiring representations and warranties concerning information security.

8 Trends in the Use of Vendors Across the Business Use of Third Parties 1% Which types of third parties are significant in your business model? Technology vendors 23% Business services 34% Equipment Marketing, sales, distribution Strategic partners 42% Raw materials Transportation/logistics "Very Few" "Moderate" Other "Significant" "Extensive" 0% 20% 40% 60% 80% 100% Source: Closing the Gaps in Third-Party Risk Management, Defining a Larger Role for Internal Audit, December 2013, Sponsored by Crowe Horwath LLP Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 8

Transportation/logistics "Very Few" "Moderate" Other "Significant" "Extensive" 0% 20% 40% 60% 80% 100% Source: Closing the Gaps in Third-Party

9 Drivers Behind Third Party Risk Cause of Data Breaches 26% 41% On average, third party errors increased the cost of data breach by as much as $43 per record in the US 33% Malicious or criminal attack Human error System error Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 9 Source: 2013 Cost of Data Breach Study: Global Analysis, Sponsored by Symantec, May 2013, Ponemon Institute

attack Human error System error Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 9

10 2015 Cloud Forecasts Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 10

11 Examples of Outsourced IT Services Cloud Services Application/Software as a Service (Cloud) Infrastructure or Platform as a Service (Cloud) Traditional IT Services Software Providers / Software Development Infrastructure/Hosting services IT Operational Services (Help Desk, Support, etc.) Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 11

Software Providers / Software Development Infrastructure/Hosting services IT

12 Vendor Management Programs Vendor management programs are becoming a more critical and intense process for the following reasons: Increase in vendor related incidents/breaches Outsourcing services and processes has never been higher Regulatory pressure Programs should have the following components: Risk Assessment Controls Assessments Ongoing Management Processes Risk Assessment Controls Assessment Ongoing Vendor Management Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 12

pressure Programs should have the following components: Risk Assessment Controls Assessments Ongoing Management Processes

13 Risk Assessment Risk Assessment Controls Assessment Ongoing Vendor Management Defined: Quantification of risk based on a series of questions Objectives: Identify the inherent risks associated with the use-case of the vendor Risk-based prioritization of vendors in order to best use resources Decide whether a controls assessment is necessary Frequency: Higher risk vendors annually Lower risk every couple years or upon material use-case change Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 13

prioritization of vendors in order to best use resources Decide whether a controls assessment is necessary Frequency: Higher

14 Controls Assessment Risk Assessment Controls Assessment Ongoing Vendor Management Defined: An evaluation of the vendor s control environment, based on your vendor standards or expectations Objectives: Identify control deficiencies relevant to this relationship or potential relationship Remediate these deficiencies through contracting or as part of the relationship management process Frequency: Prior to engaging a new vendor Thereafter based on risk or material use-case change Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 14

potential relationship Remediate these deficiencies through contracting or as part of the relationship management process Frequency:

15 Ongoing Vendor Management Risk Assessment Controls Assessment Ongoing Vendor Management Defined: Relationship management processes designed to ensure a long successful relationship Objectives: Monitor the vendor s performance and service level agreements Monitor the vendor s control compliance Risk based approach Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 15

Objectives: Monitor the vendor s performance and service level agreements Monitor the vendor

16 Controls Assessment Scope Areas SSAE16 s are not sufficient in coverage for control assessments Organizations need to establish their expectations of vendors prior to evaluating them Vendors should be evaluated against your established expectations These expectations/standards can be an adaptation of existing internal policies Establish Vendor Expectations Scope Each Assessment Controls Assessment - Identify Gaps Remediate Gaps Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 16

expectations These expectations/standards can be an adaptation of existing internal policies Establish Vendor Expectations

17 Past Events in Third Party Risk Handled as routine: Purchasing person did the review No common process between areas Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 17

18 Current Events in Third Party Risk Different Frequency Cybersecurity is critical: Vendor using cloud Online Storing Data Onus on Bank to prove that the vendor is protected Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 18

Storing Data Onus on Bank to prove that the vendor is

19 Future of Third Party Risk Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 19

20 Process for Vendor Management Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 20

21 Process for Vendor Management Ensure the process is comprehensive and consistent across the bank. Risk assess your vendors High, Moderate, Low Depends on criticality of bank What kind of data and service providing Make sure we cover everyone. Rank all vendors by level of risk. Accounting Cleaning services Paper delivery It is important vendors understand all policies and procedures. Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 21

22 Vendor Review Review is based on risk ranking Cybersecurity plays a large part in the vendor review: SOC Reports How to review a SOC Report Description of SOC Reports Web application Penetration testing Vulnerability Scan (Scan only) Penetration Test (In-depth and includes manual validation) Financials Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 22

23 Vendor Review (Cont.) Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 23

24 Vendor Review (Cont.) Data Security Where is the data being hosted? Cloud Security Insurance cyber and general liability If third party is outsourcing review information- part of agreement Encryption and Secure ? Typical questionnaire for High Vendor Must fit the vendors We don t process data so don t ask us? Connections- Secure Does SLA s meeting your RTO Know where your data is! Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 24

25 Vendor Review (Cont.) Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 25

26 Monitoring Keep track of all vendors! Secure for connections Depends on criticality of the vendor Example Key vendors have been covered Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 26

27 Recommendations Centralized process for the review Products to manage vendors Vendor Insight Hiperos RSA G2Link Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 27

28 Comments or Questions? For further information, contact: Kevin O Sullivan CISA, QSA Crowe Horwath LLP Direct: Kevin.OSullivan@crowehorwath.com Hicham Chahine CISA, CRISC Crowe Horwath LLP Direct: (614) Hicham.Chahine@crowehorwath.com Audit Tax Advisory Risk Performance 2014 Crowe Horwath LLP 28

New York State Department of Financial Services. Update on Cyber Security in the Banking Sector: Third Party Service Providers

New York State Department of Financial Services Update on Cyber Security in the Banking Sector: Third Party Service Providers April 2015 Update on Cyber Security in Banking Sector: Third-Party Service