It is astonishing to think how fast our world digitally transforms, adopts, and implements new ways of using technology. For example, as a child that grew up in the 90s, lost are activities like going to Blockbuster to rent a VHS, or standing by a wall using coins to talk on a phone attached to a cord, or using blank CDs to download music (and writing the songs on the CD with a Sharpie). People are quick to welcome new technology.
The business world has been just as quick to embrace rapid digital transformation. As all risk practitioners reading this blog are aware, changes to business mean opportunities for new risk considerations.
The financial sector within the European Union is the most recent domain to evaluate how advanced digital approaches in day-to-day business are creating vulnerabilities and increased exposure to cyber risk.
Meet DORA (aka Digital Operational Resilience Act), set to take effect in January 2025. DORA is the European Union’s response to today’s modern digital challenges, aiming to ensure that financial institutions and their critical third-party vendors can withstand and recover from cyberattacks and operational disruptions.
To comply with DORA, organizations should consider facilitating third-party compliance through a risk management platform. As a consultant for a highly configurable/scalable third-party risk management platform, here are 3 reasons why:
Best practice third-party management programs are not just reactive when unforeseen risk incidents arise, they are proactive in predicting risk before disruptions in business processes occur. DORA wants to see continuous engagement with third parties and the identification of key risk indicators before real disruptions happen.
TPRM managers need a TPRM technology platform that can engage with third parties through continuous, real-time monitoring as well as periodic monitoring set to cadences that align with your organization’s “business review check-in” requirements. Not all organizations’ check-in schedules will be the same nor will all organizations’ questions and data inputs align, so having monitoring functionality that can be configured independently and without customization constraints are areas to be sure your TPRM technology can support.
A subset of mature third-party management is contract management. DORA recognizes that contracts with third parties should include specific provisions for risk management, business continuity planning, and incident response. Like any new or emerging regulation, having a TPRM platform that can model in new risk domains and new data inputs can help your risk/compliance team(s) rest easy when leadership develops new TPRM initiatives, like standardizing contracts by offering templates that include DORA-compliant terms.
Effective contract management is more than just noting applicable regulatory provisions, it’s also about managing the contract renewal dates as well as the agreed-upon service-level agreements (SLAs). TPRM technology with conditional workflows and performance management functionalities give added opportunities to create a true, single source of truth for many/all the activities required in organizations’ TPRM programs.
Organized third-party management programs document all activities associated with their third parties. From an audit perspective, TPRM technology can play a key role in documenting and storing any type of third-party activity.
DORA requires that organizations report any digital incidents that pose operational risk. More specifically, any significant Information and Communication Technology (ICT) disruptions, particularly those caused by third-party failures, must be reported to regulators. TPRM technology that can visualize ICT disruptions over a specific period in easily digestible charts and graphs with just a few clicks is a best-in-class approach to managing the strict requirements of DORA, not to mention, a way for TPRM managers to save time while reducing the risk of errors in the reporting process.
As I mentioned at the start, we live in a rapidly evolving digital era which means we live in a rapidly evolving risk landscape that is increasingly scrutinized. The introduction of DORA to the financial sector in the European Union is the newest set of requirements for organizations to consider for their third parties in terms of how they should be monitored, what data should be in contracts with third parties, and what types of data should be reported.
Aravo’s ability to facilitate periodic monitoring as well as real-time monitoring with your data source subscriptions, configure and model additional domains and attributes, as well as document and report incidents in an auditable solution enables organizations to scale into DORA’s new requirements with comfort.
Contact Aravo to see our Intelligence First Platform® in action and learn how we can help your TPRM team prepare for DORA.
Share with Your Friends:
