Third-Party Risk Management Indicators
Key metrics for managing third-party risk
Managing third-party risk effectively requires indicators that show the state of the program at a glance and prioritize where to act, including the percentage of critical vendors assessed in the last period, the average time to remediate a critical observation found in an assessment, the number of vendors with expired certifications, and the number of incidents originating with third parties. These indicators must be broken down by criticality level, since the same percentage of completed assessments can hide the fact that precisely the most critical vendors are the ones pending review. Defining alert thresholds and reviewing them at the appropriate frequency for each risk level lets the team act before a vendor with an expired assessment becomes the source of an incident, instead of discovering the program's gap only after it happens.