COUNCIL MEETING 2014

Third Party Risk in a Global Environment: NAVEX Global Survey Findings, Best Practices and Challenges Practical Strategies for Success

Today’s Presenters: Nick Ciancio Senior Vice President, Strategic Solutions NAVEX Global Randy Stephens Vice President, Advisory Services NAVEX Global

NAVEX Global Survey Findings The following results are taken from an independent study of over 300 business professionals regarding third parties: of respondents indicated they would increase the use of third parties in the coming 12 months or weren’t sure. 92% don’t conduct any due diligence before contract negotiations begin and most companies do not conduct due diligence on third parties before onboarding them 80% conduct due diligence after contract signing 50%

Survey Findings ( cont.) Many organizations are limiting their compliance tracking to corruption and legal issues only 40% do not feel their organizations are well prepared to reduce ethics and compliance issues associated with their third parties 50% do not feel their organizations are prepared to meet new supply chain and distribution disclosure requirements

agree that ethics and compliance performance of third parties is a growing concern 85% Survey Findings ( cont.) 38% 60% of respondents have confronted issues of ethics and compliance with third parties in last 12 months agree third party ethics and compliance risks are the most important to mitigate 38% believe they monitor fewer of their third parties than they should 4% had fully automated third party risk management

Survey Findings ( cont.) Third party budgets were estimated to increase by 6% over the following 12 month period. 70% 73% 52% believe more sufficient monitoring is necessary beyond an initial screen require ethics and compliance training for third parties require code of conduct attestation

Third Party Risk Management CHALLENGES & BEST PRACTICES ChallengeBest Practice Disparate internal functions managing their third parties independently Collaboration across the enterprise

The Third Party Risk Management Process COLLABORATION ACROSS THE ENTERPRISE NAVEX Global Advisory Council 2014 Create Third Party Policies Collaboratively Access Third Party Policies by Type Review Third Party Policies

ChallengeBest Practice Disparate internal functions managing their third parties independently Business justification—cost control/spend justified Third Party Risk Management CHALLENGES & BEST PRACTICES

Provide proposed third party details and justification Automate Business Justification process with NAVEX Global Report Forms All review data stored within case record The Third Party Risk Management Process BUSINESS JUSTIFICATION

ChallengeBest Practice Third parties not fully cataloguedIdentifying universe of third parties Limited due diligence on select third parties Proportional risk management across entire universe of third parties No ongoing monitoringOngoing automated monitoring Third Party Risk Management CHALLENGES & BEST PRACTICES

Client Admin/User Portal The Third Party Risk Management Process DUE DILIGENCE AND MONITORING Third Party Risk Management Portal for Questionnaires and Document Upload

ChallengeBest Practice No mitigating actions for third parties at risk Align remediation with risk Third party risk mitigation strategy connected with actual business practices and processes Third Party Risk Management CHALLENGES & BEST PRACTICES

Choose Due Diligence Report Level Template All Case Activity The Third Party Risk Management Process Remediation

ChallengeBest Practice No legally defensible record of third party knowledge of company policies/procedures Create a record of policy attestation and provide training where possible Third Party Risk Management CHALLENGES & BEST PRACTICES

Add a Certification to each policy Add a Quiz/Survey to each Policy, to gauge understanding and gather data Embed Burst Learning to provide topically relevant instruction The Third Party Risk Management Process AWARENESS AND COMMUNICATION

Thank you