Third Party Risk Management Use Case Design

The Engagements application enables you to document all products and services delivered by a third party. You can assign engagements to business units, relationship managers, risk analysts, and to the contracts that establish the terms and conditions of the product and services being delivered.

The Archer Engagement Risk Assessment questionnaire asks the third party to document their internal control environment and provide relevant supporting documentation for further analysis. The results of these questionnaires are factored into a determination of the organization’s residual risk across several risk categories: compliance or litigation, financial, information security, reputation, resiliency, strategic, sustainability, and fourth party risk.

The Products and Services application maintains all products and services provided within an organization. For example, a financial services firm provides a variety of products and services, such as banking, brokerage, and lending services.

Note: The Products and Services application is included in the Enterprise Catalog package.

The Question Library application stores assessment questions that you can reference and copy into a questionnaire. Each question is stored as an individual record, and each record contains information including the question and answer text as well as information necessary to display and score the question. Depending on the solution that you have licensed, the Question Library contains a large set of pre-built questions by default. In addition, you can add new questions and store them in the Question Library.

The Third Party Document Repository application stores documents that a third party provides when completing their Engagement Risk Assessment questionnaires. Examples of this information include SSAE16, PCI Assessments, and Financial Statements. It allows you to store, assess, and update these documents, in addition to building reports. You can access the information in the Third Party Document Repository by doing a search within the Engagements application for a specific document. Tickler files can be set up to monitor reports that need to be updated and collected from third parties on a periodic basis.

Serves as the administrator of the use case. This role has create, read, update, and delete access rights.

Provides the appropriate access levels within the use case to the first line of defense, such as Business Unit Managers. The first line of defense is responsible for reviewing engagements and managing third party termination strategies as needed.

Provides the appropriate access levels within the use case to the executive team. The executive team is primarily responsible for reviewing third party reports.

Provides the appropriate access levels within the use case to external third parties, such as the Primary Third Party Contacts, Secondary Third Party Contacts, and Tertiary Third Party Contacts. External contacts are responsible for completing Engagement Risk Assessments.

Provides the appropriate access levels within the use case to the legal and procurement team, such as the Procurement Group and Procurement Officer. The legal and procurement team is responsible for creating third party profiles, initiating engagements, and managing contracts associated with third parties.

Provides the appropriate access levels within the use case to risk analysts. Risk analysts are responsible for initiating risk analysis for engagements, analyzing inherent risk, analyzing residual risk, and reviewing external assessments.

Provides the appropriate access levels within the use case to the second line of defense, such as Business Unit Risk Managers. Business Unit Risk Managers are responsible for the final review stage of engagement risk analysis.

The Third Party Task Driver dashboard contains quick links for frequent tasks and features relevant metrics to the current user, such as risk assessments, engagements, and expiring contracts that are pending action. This dashboard also uses interactive charts to display data, such as third parties by relationship manager and contracts by third party, status, and expiration date.

The Third Party Task Driver dashboard is available to all third party access roles because it is filtered by the current user.

The Third Party Process Manager dashboard displays items relevant to users such as relationship managers and procurement officers to help them determine how processes are functioning and identify areas for improvement. This dashboard features metrics, such as inherent risks required, residual risks required, and contracts pending review. This dashboard also uses interactive charts to show data, such as third parties by status, engagement inherent risk per business unit, and engagement residual risk per business unit.

Only users that are assigned to the Third Party: 1st Line of Defense, Third Party: Legal and Procurement, or Third Party: Administrator groups can view this dashboard.

The Link Third Party Contacts to Engagement Risk Assessment data feed automatically populates the contacts linked to a Third Party Profile into the target Engagement Risk Assessment when the following criteria is met:

1. Contacts are populated in the Third Party Profile.
2. An Engagement Risk Assessment is linked to an Engagement record that is tied to that Third Party Profile.

The data feed can link the contacts from the Third Party Profile level, Subsidiary level, or Sub-Subsidiary level.