According to a new Deloitte survey, 90% of respondents rely on third parties for some part of their business, and 70% have a moderate to high level of dependency on external entities that might include third, fourth or fifth parties.
However, it appears that companies aren’t holding these external entities to the same standards: almost half of respondents said their organization had an external entity risk incident within the past three years.
"Increasingly leaders are facing the risk of brand and reputational harm by third parties who impact customer experience or product quality," according to Dan Kinsella, leader of Extended Enterprise Risk Management (EERM) and principal at Deloitte Risk and Financial Advisory.
What are some of these extended enterprise risks, and how can they be mitigated?
Extended enterprise risks
Kinsella says the risk is heightened by the impact of social media, which can cause immediate harm to an organization. "Equally, due to changes in the business and macroeconomic environment — including regulatory pressure — many organizations are continuing to play ‘catch-up’ with the emerging set of strategic opportunities and related risks that third-parties continue to present."
Within the next 12 months, organizations are most focused on the following extended enterprise risks:
- 38% Cyber and technology
- 20% Legal, financial, and regulatory
- 11% Operational (supply chain)
- 10% Strategic (geopolitical, climate and environment, etc.)
- 5% Viral event (social media)
Prevalence of risk incidents
"In our experience, third party incidents that have potentially critical enterprise impacts are common," he says. But many of them are not reported or made public.
In fact, in Deloitte’s report, 87% of respondents faced at least one disruptive incident involving third parties in the past two to three years. And 28% faced a major disruption to all business functions because of a third-party incident.
Leaders don’t hold their extended enterprise to the same standards
"Responses to the Deloitte annual survey indicate that ownership and accountability for extended enterprise risk is well and truly established in the C-suite with some need for improvement in levels of engagement," Kinsella says. "Only 22% of the responding organizations have Board-level reviews of EERM that include alignment with organizational strategy and risk appetite on a quarterly or half yearly basis, while the vast majority of organizations surveyed (78%) review this annually or even less frequently."
But he says leadership must have deeper levels of engagement and more frequent reviews to ensure management has elevated EERM to appropriate levels, and they need to establish robust risk management structures and processes.
"We know that EERM leaders are already very busy," Kinsella says. "But as extended enterprises expand and grow in strategic importance, the expectation is that leadership will play a more engaged role with regard to third-party risks."
How leaders can help to mitigate extended enterprise risks
"Today, a large number of organizations globally utilize their Boards to carry out their risk oversight responsibilities, either by themselves, or at best, with some support from CFOs and the audit committee." Extended enterprises will continue to grow in complexity and scale, and Kinsella says more global boards may consider establishing risk committees or similar focus groups. "This will assist them in ensuring a more systematic and broader oversight of strategic and operational risks, as is currently an emerging trend in North America."
Companies are also looking at the emerging capabilities of technology-driven systems, applications, controls, and methodologies. "According to the survey, respondents are likely to invest in cloud computing, robotics process automation, data visualization, cognitive technologies, blockchain, and the Internet of Things," Kinsella explains. These tools can help companies improve compliance and decrease risks from regulatory missteps, reputation damage, cyber threats, and consumer backlash.
In earlier Deloitte surveys, companies were overly optimistic and thought they could achieve EERM maturity in six months. "But now, 53% of respondents believe that their journey to achieve the desired state of EERM maturity is two to three years or more," Kinsella says.
