Third Party Governance Use Case Design

The Third Party Metrics application allows you to document all of the performance indicators and SLA metrics related to each of the engagements being delivered by a third party. The overall performance of the third party is scored relative to each engagement, and the results across all of the third party engagements are rolled up to obtain an overall performance score for the third party. Performance metrics can be tracked against upper and lower thresholds, expected direction, and +/- 2 standard deviations from the historical mean.

The Archer Third Party Metrics Library contains the pool of metrics that you commonly use, and allows you to avoid manual metric setup while enforcing consistency in your metrics program across all engagements. The third party metrics that you select from the library automatically populate the Third Party Metrics section of the Engagement record.

The Third Party Metrics Results application enables you to capture the historical data of individual metrics, including the metric reporter, metric sources, metric date, and metric value, as well as any supporting documentation.

The Technologies application provides a searchable and extensible repository of technology version information that can be leveraged to relate devices of like technology. Devices can be identified and grouped using one of the three tiered hierarchical values lists detailed:

• Operating System Technology. This list details information such as the operating system vendor, product, and version of the operating system.
• Application Technology. This list contains information such as the application vendor, name, and version of the application.
• Hardware Technology. This list describes information relating to hardware vendor, including name, description, and technology version naming conventions.

Users can filter technologies that have been company approved and view reports detailing known vulnerabilities threatening their technologies.

Note: The Technologies application is included in the Enterprise Catalog package.

The Applications application stores all software applications used by the organization to perform business operations. You can view how an application is used, the people that use it, and the devices on which the application is installed. You can also track the business impact, customer impact, and licensing details, and associate it with other aspects of the enterprise infrastructure.

Note: The Applications application is included in the Enterprise Catalog package.

The Devices application serves as a central repository for knowledge, such as criticality, about IT devices and which applications they support. You can manage devices to ensure that they are protected according to management expectations. The application is also associated with other aspects of the enterprise infrastructure.

Note: The Devices application is included in the Enterprise Catalog package.

Serves as the administrator of the use case. This role has create, read, update, and delete access rights. The Third Party: Administrator is responsible for populating the Third Party Metrics Library.

Provides the appropriate access levels within the use case to the first line of defense, such as Business Unit Owners, Business Unit Managers, and Relationship Managers.

Provides the appropriate access levels within the use case to the executive team.

Provides the appropriate access levels within the use case to external third parties, such as the Primary Third Party Contacts, Secondary Third Party Contacts, and Tertiary Third Party Contacts.

Provides the appropriate access levels within the use case to the legal and procurement team, such as the Procurement Group and Procurement Officer.

Provides the appropriate access levels within the use case to risk analysts. Risk analysts are responsible for associating metrics with engagements, activating metrics, and collecting metrics results.

Provides the appropriate access levels within the use case to the second line of defense, such as Business Unit Risk Owners.

The Third Party Task Driver dashboard contains quick links for frequent tasks and features relevant metrics to the current user, such as supplier request forms, risk assessments, contract reviews, and expiring contracts that are pending action. This dashboard also uses interactive charts to display data, such as third parties by relationship manager and contracts by third party, status, and expiration date.

The Third Party Task Driver dashboard is available to all third party access roles because it is filtered by the current user.

The Third Party Process Manager dashboard displays items relevant to users such as relationship managers and procurement officers to help them determine how processes are functioning and identify areas for improvement. This dashboard features metrics, such as expiring contracts, contracts pending review, and metrics collections past due. This dashboard also uses interactive charts to show data, such as third parties by status and engagement distribution per business unit.

Only users that are assigned to the Third Party: 1st Line of Defense, Third Party: Legal and Procurement, or Third Party: Administrator groups can view this dashboard.