Use Cases to Leverage Exchange Data in Third Party Risk Management

Introduction

The Third-Party Risk Exchange enables organizations to leverage input from external data sources to manage third parties. This article outlines two use cases to effectively leverage Exchange data within the Third Party Risk Management product to drive meaningful risk insights and automation.

Why Use Exchange Data?

Exchange data provides external risk intelligence from trusted providers such as SecurityScorecard and RiskRecon, which can be used to:

  • Inform vendor selection

  • Trigger action based on risk thresholds

  • Monitor third parties for changes in score

Implementation Guide

To embed exchange scores in a vendor workflow

In the vendor workflow, users can reference Exchange scores in rule conditions to trigger action or change a vendor workflow stage. While evaluating a vendor through the workflow, the Exchange scores are helpful data points to tailor follow up actions.

  1. Select the workflow stage where you would like to evaluate Exchange scores.

    The vendor must be connected to an Exchange profile in order for the scores to be populated on the vendor record, so consider when the Exchange connection will be established and confirm the vendor will be connected to an Exchange profile upon entering this workflow stage.



  2. Determine the key score and threshold which require follow up or inform how the vendor should be routed.

    For example: An organization wants to know when a vendor's SecurityScorecard Score is below 80. See Viewing Vendor Scores and Ratings  for more information about exchange scores provided.

  3. Configure stage or workflow rules to trigger the appropriate action based on the vendor’s score.

    Exchange score attributes can be used in rule conditions and combined with other vendor data, such as criticality or inherent risk score, to tailor actions based on business risk. See Adding Stage Rules to Vendor Workflows for details on how to configure rules.

    Example actions:

    • Stage rule - Send notification,

    • Create Task

    • Send Assessment

    If SecurityScorecard Score is below 80, you can trigger an action to further review vendor.

    Common actions include sending notifications to inform a vendor reviewer, creating a task to review the Exchange profile, or sending an assessment for further follow up. For the Send Notification action, the score can be added to the body of the email by using the Add Variables action.





To monitor for changes in exchange scores

For vendors already been onboarded, automation rules can be used to monitor for changes in exchange scores. See Managing Third-Party Risk Management Automation Rules for more context.

  1. Within Automation Rules, select or create a rule group then add a vendor type rule.


  2. In the Condition Trigger field, select the Attribute Change Percentage trigger type. This will compare the current score to a previous score notify the user when a score changes by a certain amount. Attribute change percentage is used instead of the attribute value itself to avoid redundant alerts and focus on meaningful changes.
  3. Choose the key metric and change threshold that should trigger review. For example, notify the vendor manager if a RiskRecon score drops by 10%:


    Add filters as needed. For example, a vendor manager may only want to be notified of these score changes for high risk vendors. If so, risk can be added as an additional condition in the rule so the vendor manager will only be notified of RiskRecon score changes for high risk vendors: