Identify and Manage Financial Risk Impacts on Your Organization

Good vendor management practices help organizations understand the costs of negative vendor actions.

Analyst Perspective

Vendor actions can have significant financial consequences for your organization.

Vendors are becoming more influential and essential to the operation of organizations. Often the sole risk consideration of a business is whether the vendor meets a security standard, but vendors can negatively impact organizations’ budgets in various ways. Fortunately, though inherent risk is always present, organizations can offset the financial impacts of high-risk vendors by employing due diligence in their vendor management practices to help manage the overall risks.

Frank Sewell
Research Director, Vendor Management
Info-Tech Research Group

Executive Summary

Info-Tech Insight

Companies without good vendor management risk initiatives will take on more risk than they should. Solid vendor management practices are imperative –organizations must evolve to ensure that vendors deliver services according to performance objectives and that risks are managed accordingly.

Info-Tech’s multi-blueprint series on vendor risk assessment

There are many individual components of vendor risk beyond cybersecurity.

This series will focus on the individual components of vendor risk and how vendor management practices can facilitate organizations’ understanding of those risks.

Out of scope:
This series will not tackle risk governance, determining overall risk tolerance and appetite, or quantifying inherent risk.

Financial risk impact

Potential losses to the organization due to financial risks

In this blueprint, we’ll explore financial risks and their impacts.

Identifying negative actions is paramount to assessing the overall financial impact on your organization, starting in the due diligence phase of the vendor assessment and continuing throughout the vendor lifecycle.

Unbudgeted financial risk impact

The costs of adverse vendor actions, such as a breach or an outage, are increasing. By knowing these potential costs, leaders can calculate how to avoid them throughout the lifecycle of the relationship.

Example: Hospital IT System Outage

Hospitals often rely on vendors to manage their data center environments but rarely understand the downstream financial impacts if that vendor fails to perform.

For example, a vendor implements a patch out of cycle with no notice to the IT group. Suddenly all IT systems are down. It takes 12 hours for the IT teams to return systems to normal. The downstream impacts are substantial.

• There is no revenue capture during outage (patient registration, payments).
  • The financial loss is significant, impacting cash on hand and jeopardizing future projects.
• Clinicians cannot access the electronic health record (EHR) system and shift to downtime paper processes.
  • This can cause potential risks to patient health, such as unknown drug interactions.
  • This could also incur lawsuits, fines, and penalties.
• Staff must manually add the paper records into the EHR after the incident is corrected.
  • Staff time is lost on creating paper records and overtime is required to reintroduce those records into EMR.
• Staff time and overtime pay on troubleshooting and solving issues take away from normal operations and could cause delays, having downstream effects on the timing of other projects.

Insight Summary

Assessing financial impacts is an ongoing, educative, and collaborative multidisciplinary process that vendor management initiatives are uniquely designed to coordinate and manage for organizations.

Three stages of vendor financial risk assessment

Assess risk throughout the complete vendor lifecycle

1. Pre-Relationship Due Diligence: The initial pre-relationship due diligence stage is a crucial point to establish risk management practices. Vendor management practices ensure that a potential vendor’s risk is categorized correctly by facilitating the process of risk assessment.
2. Monitor & Manage: Once the relationship is in place, organizations should enact ongoing management efforts to ensure they are both getting their value from the vendor and appropriately addressing any newly identified risks.
3. Termination: When the termination of the relationship arrives, the organization should validate that adequate protections that were established while forming a contract in the pre-relationship stage remain in place.

Inherent risks from negative actions are pervasive throughout the entire vendor lifecycle. Collaboratively understanding those risks and working together to put proper management in place enables organizations to get the most value out of the relationship with the least amount of risk.

Stage 1: Pre-relationship assessment

Do these as part of your due diligence

The “what if” game

Input: List of identified potential risk scenarios scored by likelihood and financial impact, List of potential management of the scenarios to reduce the risk

Output: Comprehensive financial risk profile on the specific vendor solution

Materials: Whiteboard/flip charts, Financial Risk Impact Tool to help drive discussion

Participants: Vendor Management – Coordinator, IT Operations, Legal/Compliance/Risk Manager, Finance/Procurement

Vendor management professionals are in an excellent position to collaboratively pull together resources across the organization to determine potential risks. By playing the “what if” game and asking probing questions to draw out – or eliminate – possible negative outcomes, everyone involved adds their insight into parts of the organization to gather a comprehensive picture of potential impacts.

1. Break into smaller groups (or if too small, continue as a single group).
2. Use the Financial Risk Impact Tool to prompt discussion on potential risks. Keep this discussion flowing organically to explore all potential risks but manage the overall process to keep the discussion on track.
3. Collect the outputs and ask the subject matter experts for management options for each one in order to present a comprehensive risk strategy. You will use this to educate senior leadership so that they can make an informed decision to accept or reject the solution.

Download the Financial Risk Impact Tool

Stage 2.1: Monitor the financial risk

Ongoing monitoring activities

Never underestimate the value of keeping the relationship moving forward. Examples of items and activities to monitor include;
Fines Data leaks Performance Credit monitoring Viability/solvency	Resource capacity Operational impacts Regulatory penalties Increases in premiums Security breaches (infrastructure)
Info-Tech Insight Many organizations do not have the resources to dedicate to annual risk assessments of all vendors. Consider timing ongoing risk assessments to align with contract renewal, when you have the most leverage with the vendor.		Visit Info-Tech’s Risk Register Tool

Stage 2.2: Manage the financial risk

During the lifecycle of the vendor relationship

Renew risk assessments annually. Focus your efforts on highly ranked risks. Is there a new opportunity to negotiate? Identify and classify individual vendor risk. Are there better existing contracts in place? Review financial health checks at the same time. Monitor and schedule contract renewals and new service/module negotiations. Perform business alignment meetings to reassess the relationship. Ongoing operational meetings should be supplemental, dealing with day-to-day issues. Develop performance metrics and hold vendors accountable to established service levels.

Stage 3: Termination

An essential and often overlooked part of the vendor lifecycle is the relationship after termination

The risk of a vendor keeping your data for “as long as they want” is high. Data retention becomes a “forever risk” in today’s world of cyber issues if you do not appropriately plan. Ensure that you always know where data resides and where people are allowed to access that data. If there is a regulatory need to house data only in specific locations, ensure that it is explicit in agreements. Protect your data through language in initial agreements that covers what needs to happen when the relationship with the vendor terminates. Typically, all the data that the vendor has retained is returned and/or destroyed at your sole discretion.

Related Info-Tech Research

	Design and Build an Effective Contract Lifecycle Management Process Achieve measurable savings in contract time processing, financial risk avoidance, and dollar savings Understand how to identify and mitigate risk to save the organization time and money.
	Identify and Reduce Agile Contract Risk Manage Agile contract risk by selecting the appropriate level of protections for an Agile project. Focus on the correct contract clauses to manage Agile risk.
	Jump Start Your Vendor Management Initiative Vendor management must be an IT strategy. Solid vendor management is an imperative – IT organizations must develop capabilities to ensure that services are delivered by vendors according to service level objectives and that risks are mitigated according to the organization's risk tolerance. Gain visibility into your IT vendor community. Understand how much you spend with each vendor and rank their criticality and risk to focus on the vendors you should be concentrating on for innovative solutions.